# Presentation: 413989

## Overview of 42 CFR Part 2 and HIPAA

**Notes:**
CSAT is developing a crosswalk analyzing the privacy regulations promulgated under HIPAA against the federal regulations governing the confidentiality of alcohol and substance abuse treatment records (42 CFR Part 2).

The confidentiality regulations were adopted back in 1975.  Until HIPAA, these regulations were the only Federal confidentiality regulations protecting patient information.  In general, most confidentiality requirements are governed by state law.

42 CFR Part 2 is designed to encourage people to seek treatment by offering stringent confidentiality protections.  This presentation is intended to provide you with a summary crosswalk of those requirements as compared to the new privacy regulations.     

## HIPAA

- Health Insurance Portability and Accountability Act of 1996
- Administrative Simplification Provisions - national standards to facilitate the electronic exchange of health information and to protect the privacy of patient identifying health information

## Privacy Regulations - Deadline for Compliance

- Deadline for compliance - April 14, 2003
- Small health plans (annual receipts of $5 million or less) - deadline for compliance is April 14, 2004

## Transactions and Code Sets Regulations - Deadline for Compliance

- Deadline for compliance - October 16, 2002
- Small health plans (annual receipts of $5 million or less) - deadline for compliance is October 16, 2003
- Extension now available - Covered entity (other than a small health plan) must submit request for extension by October 15, 2002. New deadline if extension granted is October 16, 2003
- Model extension request form and instructions http://www.cms.gov/hipaa/hipaa2/default.asp

## 42 CFR Part 2

- Confidentiality of Alcohol And Drug Abuse Patient Records
- Also 42 U.S.C. §290dd-2

## The Framework of Principles

- Privacy is the right of the individual to be left alone.
- Confidentiality is the responsibility for limiting disclosure of private matters.
- Security is the means to control access and protect information from accidental or intentional disclosure.
- Definitions courtesy of Guardent.

**Notes:**
Conceptual framework showing privacy as a multifaceted concept

The person who possesses the information (i.e., given the information by the owner) has an obligation to protect it from accidental or intentional disclosure (confidentiality and security).  Treat it with respect.

2/3 of Americans fear leaks of health information
1/5 of Americans believe they are victims of improper disclosure
2/3 of Americans do not trust health plans or government to maintain confidentiality all or part of the time
1/6 of Americans report privacy protective behaviors
  not providing complete or accurate information
  not even going to the doctor *

*  California Health Care Foundations, January 1999

## Applicability

- 42 CFR Part 2
- Federally-assisted Substance Abuse Treatment Programs
- Definition of federally-assisted

- HIPAA
- Health Plans
- Health Care Clearinghouses
- Health Care Providers that transmit electronic information

**Notes:**
Individual or entity (or identified unit within general medical facility) which holds itself out as providing, and provides, alcohol and drug abuse diagnosis, treatment or referral for treatment or medical personnel or other staff in a general medical care facility whose primary function is the provision of alcohol or drug abuse treatment or referral for treatment and who are identified as such.

Prevention programs are covered if they meet the definition. 

## Who is considered a patient?

- 42 CFR Part 2
- Patient means any individual who has applied for or been given diagnosis or treatment for alcohol or drug abuse at a federally assisted program and includes any individual who, after arrest on a criminal charge, is identified as an alcohol or drug abuser in order to determine that individual’s eligibility to participate in program.

- HIPAA
- The person who is the subject of the protected health information
- The individuals and organizations who are subject to HIPAA regulations as a CE or BA.

## Protected Health Information

- Individually Identifiable Health Information which is:
- Created or received by a health care provider, health plan, employer or health care clearinghouse
- Related to the past, present or future physical or mental health or condition of an individual
- Related to the provision of health care to an individual
- Related to the past, present or future payment for the provision of health care to an individual
- Identifies the individual or there is reasonable basis to believe that the information can be used to identify the individual
- Is transmitted by electronic media or maintained in any medium

**Notes:**
Information not necessarily stored in a hard copy version, hence oral and electronic information is also protected.

Information that identifies you:  18 items from name and social security number to biometric identifiers, URLs and IP addresses.  87% of people can be uniquely identified by birth date, sex, and zip code.
If information is de-identified, it is removed from protected status.

## Patient Identifying Information 

- HIPAA
- Same: 42 CFR Part 2 PLUS
- Address is defined more broadly
- Names of relatives/household
- Name of employer
- Variety of dates
- Telephone/fax number
- E-mail address/URL/IP
- Medical record number
- Account/health plan number
- Vehicle or other device serial number

- 42 CFR Part 2
- Name
- Address
- Social Security Number
- Fingerprints
- Photograph
- Other similar info
- Does not include a number assigned to a patient by a program - different than HIPPA.

**Notes:**
Note:  These are not complete lists.

## Prohibition on Redisclosure

- 42 CFR Part 2
- Can only disclose pursuant to a consent or other permitted purpose
- Prohibition against redisclosure of information to another - can only disclose to those named in consent
- Must include a written prohibition statement to accompany the consent
- Any recipient of information is subject to the rule and may not disclose the information except as permitted by the rule.

- HIPAA
- No specific prohibition against redisclosure
- However, if the entity is a covered entity or a business associate, privacy protections continue to apply

## Patient Access to Records 

- 42 CFR Part 2
- No consent nor authorization required
- Also subject to restriction on use 2.23(b)

- HIPAA
- Patient has right to access own records
- Exceptions:
- Psychotherapy notes
- Information compiled in anticipation of civil, criminal or administrative proceeding
- Info subject to CLIA or exempt from CLIA

**Notes:**
CLIA: Clinical Laboratories Improvement Act.

## Subpoenas/Court Orders

- 42 CFR Part 2
- A subpoena alone is not sufficient to release information - a court order is also required - must be issued by judge in accordance with specific procedures and criteria

- HIPAA
- Can disclose in response to a court (or administrative tribunal) order only, or a subpoena and court order, or by discovery request or lawful process alone

## Patient Rights

- 42 CFR Part 2
- Patients must be given written summary of confidentiality provisions and notice that Federal law and regulations protect the confidentiality of alcohol and drug abuse patient records.

- HIPAA
- Receive notice of covered entity’s privacy practices
- Access own information
- Request corrections of erroneous/incomplete information
- Request restriction of uses and disclosures
- Request transmittal of communications in an alternative manner
- Obtain an accounting of disclosures

## Child Abuse/Neglect

- 42 CFR Part 2
- Specific exception allows reporting of child abuse/neglect
- Restrictions on disclosure and use continue to apply to the original alcohol and drug abuse patient records maintained by the program including their disclosure or use for criminal or civil proceedings which may arise out of the report

- HIPAA
- Allows a report to appropriate authorities of abuse, including child abuse

## Law Enforcement

- 42 CFR Part 2
- Generally cannot disclose information without subpoena and court order - arrest/search warrant not sufficient
- Can disclose for crime committed by patients on program premises or against program personnel or a threat to commit such a crime

- HIPAA
- Can disclose to law enforcement and jails without consent/authorization:
- As required by law
- With a subpoena
- With a warrant
- To locate missing persons
- Victim of crime
- Crime on program premises

**Notes:**
Disclosures are limited to circumstances of incident, including the patient status of the individual committing or threatening to commit the crime, the individual’s name, address and last known whereabouts.

## Public Health Authorities/Disease Reporting

- 42 CFR Part 2
- No specific exemption for reporting - need consent, court order, or can report if done anonymously
- Can disclose to FDA if error in manufacturing e.g., labeling or sale of drug used in treatment - exclusive purpose notifying patients and their physicians of potential dangers.

- HIPAA
- Authority to disclose to public health authorities for a variety of circumstances without patient authorization

## Other HIPAA Privacy Mandates

- Designate a Privacy Officer
- Adopt written comprehensive policies
- Train staff routinely
- Personnel sanctions for breaches
- Establish a grievance process
- Physical safeguards
- Mitigate results of violations
- Minimum Necessary Requirement
- Privacy Notice
- Accounting of Disclosures
- Correction of erroneous/incomplete information

**Notes:**
These are significant mandates, but not necessarily unique to HIPAA - 42 CFR Part 2 also has a minimum necessary requirement

While these things are beyond the scope of this discussion, it is important to note that to properly implement HIPAA all these things are necessary, and that privacy and security regulations go hand in hand - there must be proper security measures in place to ensure protection of the privacy of PHI

## Enforcement, Compliance and Penalties

- 42 CFR Part 2
- Enforcement - United States Attorney for judicial district in which the violation occurs
- Criminal penalties - not more than $500 for 1st offense; no more than $5,000 for each subsequent offense

- HIPAA
- Enforcement - HHS’ Office of Civil Rights
- Penalties - Civil - $100/person per violation up to $25,000
- Criminal - $50,000/up to 1 year imprisonment for wrongful disclosure
- Intent to sell, transfer or use PHI for gain - $250,000/up to 10 years imprisonment