Source: https://compliancecosmos.org/8-42-code-federal-regulations-part-2-federally-assisted-alcohol-drug-records
Timestamp: 2019-05-19 06:33:51
Document Index: 232421110

Matched Legal Cases: ['art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', '§164', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', '§ 164']

8 42 Code of Federal Regulations, Part 2: Federally Assisted Alcohol Drug Records | Cosmos
By David B. Nelson, CHPC, CHRC, CIPP/G, CIPP/US, CISSP[1]
42 Code of Federal Regulations, Part 2: Federally Assisted Alcohol Drug Records
Applicability of Part 2
Information Subject to Part 2
42 C.F.R. Part 2 (“Part 2”) was enacted in the 1970s to govern the confidentiality of alcohol and drug treatment and prevention information. The purpose of the regulations was to protect the privacy of information so that people would seek treatment and not be stigmatized by these services.
This chapter is designed to give a general outline of the most important compliance pieces of Part 2:
Applicability of Part 2.
Definition of information subject to Part 2.
The defined disclosures.
Credit must be given here to the “Legal Action Center” whose mission, as a non-profit law and policy organization, is to be an advocate for public policy to fight discrimination against people with histories of addiction, HIV/AIDS, or criminal records. The author expresses his gratitude for their continual effort in providing trainings and resources for Part 2 entities compliance. To access their resources, please go to www.lac.org/.
The cornerstones of applicability for Part 2 consists of two pieces: Drug/alcohol treatment “programs”[2] that are “federally assisted.”[3] The two definitions, “program” and “federally assisted,” are sometime contested, so it is important for the privacy professional to set aside any HIPAA or other definitions from this process and use only Part 2 to make a determination.
A program is “federally assisted” if it:
Receives federal funds in any form (even if not used for drug/alcohol services).
Is assisted through IRS (tax exempt status or tax deductions for contributions).
Is authorized to conduct business by the federal government ( e.g., has DEA license to provide methadone or receives Medicaid or Medicare reimbursement).
Conducted directly by the federal government, or by state/local government that receives federal funds which could be spent for drug/alcohol services (but don’t have to be).
It should be relatively easy to spot if an entity receives federal funds, in fact it is probably the exception where an entity does NOT receive federal funds. The last bullet incorporates reimbursement from local government. Just because the money passes through the local government, it does not change the source, so reimbursements for such things as immunizations or TB screening could come from a federal source.
The second bullet pulls in all non-profits under the IRS tax code 501-C series. These entities are assisted via their tax status. State and local government are also considered federally assisted.
The term “program” means:
An individual or entity, other than a general medical facility, that holds itself out as providing, and does provide, drug/alcohol diagnosis, treatment, or referral for treatment.
Included would be an identified unit within a general medical facility which holds itself out as providing, and does provide, drug/alcohol diagnosis, treatment, or referral for treatment.
Medical personnel or other staff in a general medical care facility whose primary function is the provision of drug/alcohol diagnosis, treatment, or referral for treatment, and who are identified as such.
For clarity a definition of “holds itself out” is necessary. While regulations do not specify, the Substance Abuse and Mental Health Services Administration (SAMHSA) declares the definition would include:
State licensing procedures.
Advertising or posting notices in office.
Certifications in addiction medicine.
Listings in registries.
Internet statements.
Consultation activities for non- “programs”.
Information given to patients and families.
Any activity that would reasonably lead one to conclude those services are provided.
Some examples of programs are:
Freestanding licensed drug/alcohol treatment program.
Student assistance program in a school.
Primary care providers who provide drug/alcohol services as part of their principal practice.
A detox unit.
Inpatient or outpatient drug/alcohol program.
The caveat in the first bullet of “other than a general medical facility” is clarified to mean if a general medical facility does NOT have an identified unit for the provision of alcohol drug treatment, they are not subject to Part 2. Just because Dr. Welby has a license to prescribe buprenorphine for opiate addiction, does not mean he, or the facility where he has privileges, are Part 2 entities. The key being “holds itself out” and “an identified unit” for alcohol drug abuse treatment. An example would be the Betty Ford Clinic versus the Rady Children’s Hospital San Diego. Rady’s may have to treat a child with drug addiction from birth, but it is not a separate unit of the hospital system. Betty Ford, on the other hand, clearly offers the services from a specified licensed, certified unit.
There is a very inclusive definition of the information subject to Part 2. Specifically, it is “patient identifying information”[4] and would refer to:
Having a past or current drug/alcohol problem or
Being a past or current patient in a drug/alcohol program.
Then we have to clarify, what is a “patient”[5] ? According to Part 2, a patient is:
Anyone who now or has ever received services from a Part 2 program.
Anyone who has even applied for services from a drug/alcohol program covered by Part 2, whether they accessed services or not, such as someone who makes an appointment but doesn’t show up.
The content of the information includes:
name, address, SSN, fingerprints, photos, and other information by which a patient’s identity can be determined with reasonable accuracy.
Demographic data that does not reveal (directly or indirectly) that someone was a patient or had drug/alcohol problem, such as aggregate data, information that someone receives/received services from a mixed-use facility (e.g., general medical facility, community mental health center, etc.)
Note: Part 2 and HIPAA are in conflict, as demographic data is part of the HIPAA Designated Record Set[6] but only may be included in the Part 2 information set (if it “does not reveal…”). So any information that can be used to identify individuals, or can be reasonably used to determine their identity, and specifically links them to alcohol drug services, even if they did not access them, is subject to Part 2.
Disclosure under Part 2
[7] The actionable piece of Part 2 information confidentiality is linked to “disclosure.” This term is substantially different than the term defined by HIPAA, and specifically includes communications to people who already know the information.
Disclosure means:
A communication of patient-identifying information.
The affirmative verification of another person’s communication of patient identifying information.
The communication of any information from the record of a patient who has been identified.
The last bullet captures anything that might be in the record, so (again) it should be noted that this does not match the HIPAA designated record set. Additionally, “Records” can be written, oral, or electronic, which is similar to HIPAA’s “in any format” stipulation.
Part 2 programs have a set of specified disclosures that are permitted without the client authorization; many are similar to HIPAA’s. Specifically:
Internal Communication ( e.g. internal billing, scheduling…).
Where no Identifying Information is included.
Qualified Service Organization[8] (QSOs are separate legal entities who, like a HIPAA BA, are performing a service on behalf of the Part 2 entity).
Crime on the Premise
Most disclosures are allowed if a patient signs a valid consent form (“authorization” under HIPAA) that has not expired or been revoked. The form must adhere to proper format, again similar to the HIPAA authorization. For an authorization to be valid for Part 2, it must include:
Name/general designation of program making disclosure
Name of individual/entity receiving disclosure
Name of patient who is the subject of disclosure
Purpose/need for disclosure
Description of how much and what kind of information will be disclosed
Patient’s right to revoke consent, and any exceptions
Date/event/condition on which consent expires
There are eleven elements defined in 45 C.F.R. §164.508 for the valid HIPAA authorization. If the Part 2 program is also covered by HIPAA, frequently the case, both sets of mandates must be on the form for it to be valid. Be aware that some states, such as California Civil Code 56.11(a), might have additional mandates for the form to be valid.
Of special concern is the Part 2 mandate of “how much and what kind of information,” which invokes the minimum necessary without the caveat of “does not apply to treatment.” Part 2 programs must always limit the information, even in treatment situations. “Any disclosure made under these regulations must be limited to that information which is necessary to carry out the purpose of the disclosure.”[9]
Note: Special consideration of the previous point must occur when developing, or reviewing, the access authorization process to an Electronic Health Record (EHR). Role-based access, in a general medical setting where a single EHR is implemented and Part 2 programs exist, may not be sufficient. Frequently, systems of care with Part 2 services use a separate EHR so that unauthorized “Part 2 disclosures” do not happen.
Part 2 Preemption
The preemption of federal law for 42 C.F.R. Part 2 programs is different than that of HIPAA.
Part 2 overrides less protective state law (similar to HIPAA), but state laws may not authorize or compel disclosures prohibited by 42 C.F.R. Part 2 (unlike HIPAA’s “except where mandated by other law”). The privacy professional should create a matrix for references, and training, on this complex interaction, because there is no federal preemption between the two federal regulations. An entity, if both laws are applicable, must figure out how to abide by both sets of regulations.
Part 2 confidentiality mandates are more restrictive than HIPAA because the information set is very inclusive, the disclosure content must be limited, and the window for disclosures is very small. This combination of restrictions must be translated by the privacy professional so that the client is served appropriately, not stigmatized by unauthorized disclosures, and will therefore seek Part 2 services when necessary.
42 C.F.R. pts. 2, Subpts.
45 C.F.R. §§ 164.501.