Health Care Privacy Compliance Handbook, 3rd Edition

History

The original Part 2 regulation combined two existing laws—one for alcohol abuse and one for drug abuse—in the 1970s to govern strict confidentiality of program information. The purpose of these regulations was to protect the privacy of information so that people would seek treatment and not be stigmatized because they had sought treatment. There were revisions in 1975, 1982, 1987, 2018, and 2020. The 2018 updates bring the regulation up to speed with more recent technology, such as the internet and electronic health records (EHRs), and changed the term “alcohol and drug abuse” to “substance use disorder” (SUD).

Outline

The important compliance pieces of Part 2 that will be discussed here are:

• Purpose

• Applicability

  • Two determination steps: “program” and “federally assisted”

• Information subject to Part 2

• Permitted disclosures without consent/authorization

• Permitted disclosures with consent

• Mandates for legal recipients

• Preemption

• Reporting violations

In brief, the focus is on whom the regulations apply to, what information is covered, the key ways to legally share information without the client’s written permission, and the downhill effect on recipients of Part 2 information.

Credit must be given here to the Legal Action Center (http://www.lac.org ), a nonprofit law and policy organization that is an advocate for public policy to fight discrimination against people with histories of addiction, HIV/AIDS, or criminal records. The author expresses his gratitude for their continual effort in providing training and resources for Part 2 compliance, particularly their abridged and updated guide addressing Part 2 and HIPAA fundamentals.^[4]

Determination Step One

A program is federally assisted if it:

• Receives federal funds in any form (even if not used for SUD services).

• Is assisted through IRS tax-exempt status or tax deductions for contributions.

• Is authorized (through license, certification, registration, or other authorization) to conduct business by the federal government (e.g., has a Drug Enforcement Administration license to provide methadone, or receives Medicaid or Medicare reimbursements).

• Is conducted directly by the federal government or by a state/local government that receives federal funds that could be spent for SUD services (but don’t have to be).^[6]

It should be relatively easy to spot if an entity receives federal funds—in fact, it is probably the exception where a healthcare entity does NOT receive some federal funds. A simple search of the budget and sources of revenue should identify federal funds. However, be cautious. Just because the money passes through another entity (such as a local government) does not negate the federal source. Contracts with local or state governments frequently include the phrase “if federal funds are available.” This phrase directly implies that the source is federal funds. The last bullet in the determination process incorporates the downhill reimbursement of federal funds to local government for SUD services.

The second bullet in the determination process pulls in all nonprofits under IRS code 501(c). These entities are assisted via their tax status. State and local governments are also considered federally assisted; however, there are some exclusions for the Department of Veterans Affairs and the armed forces.

Determination Step Two

The term “program” means:

• An individual or entity (other than a general medical facility) who holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or

• An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or

• Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.^[7]

To help clarify the definition, it is necessary to understand the phrase “holds itself out.” While regulations do not specify, the Substance Abuse and Mental Health Services Administration (SAMHSA) declares that it could include:

• State licensing procedures

• Advertising or posting notices in the office

• Certifications in addiction medicine

• Listings in registries

• Internet statements

• Consultation activities for nonprograms

• Info given to patients and families

• Any activity that would reasonably lead one to conclude those services are provided^[8]

Some examples of programs are:

• Freestanding licensed SUD treatment programs

• Student SUD assistance in a school

• Primary care providers who provide SUD services as part of their principal practice

• A detox unit

• Inpatient or outpatient SUD services

There is a caveat in the first bullet of the program definition, concerning the phrase “other than a general medical facility.” It is relatively clear that if a general medical facility does not have an identified unit for the provision of SUD treatment, they are probably not subject to Part 2. Just because Dr. Welby has a license to prescribe buprenorphine for opiate addiction and works in the general medical facility does not mean he, or the facility where he has privileges, is a Part 2 entity. The link to look for is the phrase “holds itself out” as providing SUD abuse treatment. An example would be a Hazelden Betty Ford clinic versus the Rady Children’s Hospital-San Diego. Rady’s may have to treat a child with drug addiction from birth, but it is not (at this writing) a separate unit of the hospital system. Hazelden Betty Ford, on the other hand, clearly offers, publicly on the internet, the SUD services from a specified licensed/certified unit.

Note: There is some debate based on a SAMHSA FAQ^[9] that if a referral for SUD services in a general medical facility occurs, but the individual who refers the patient does handle not referrals as their primary purpose (i.e., is not assigned), is this referral process considered a program under the definition? This is a risk decision. If the occasional referral for SUD services happens, there is little risk associated with not declaring the referral process a program. However, if the referral process receives any information about the client from the SUD program, that information would be subject to Part 2. An entity that regularly makes SUD referrals, receives information back from the SUD program, requests any information from a SUD program, and has regular contact with a SUD program would have a hard time justifying that it is not running a program. In that case, the risk is more substantial. If it looks like a duck and quacks like a duck—maybe. But if it looks like, quacks like, and lives in the duck pond—it is a duck. Apply the regulation first and then use other guidance. SAMHSA FAQs do not replace the application of the regulations.