42 CFR Part 2

While almost every EHR on the market offers HIPAA security & safeguards, not all of them provide the functionality to support 42 CFR Part 2. For many Substance Use facilities, HIPAA’s not enough! If you’re a clinician that offers treatment for SUDs (Substance Use Disorder), you probably have to adhere to the stricter mandates of 42 CFR Part 2 – and need an EHR program that can support these protocols.

What is 42 CFR Part 2 and to whom does it apply?

Along with HIPAA, 42 CFR (US Federal Code of Regulations), Part 2 aims to protect the confidentiality of those receiving treatment of SUDs by prohibiting unauthorized disclosures of patient records, except in limited circumstances.

Because it applies to any individual or entity that is federally assisted and provides alcohol or drug use diagnosis, treatment, or referral for treatment (42 CFR § 2.11), it applies to many drug and alcohol treatment providers & programs.

Part 2 recognizes the sensitivity of SUD patient records by requiring a special court order, before turning over client records, in response to a subpoena, search warrant, or law enforcement request.

How does it differ from HIPAA?

HIPAA applies to organizations that transmit or receive billing data electronically and is generally less prohibitive in sharing PHI than Part 2:

// One of the most important differences between Part 2 and HIPAA is the privacy protections for patient records in criminal & civil legal proceedings, as outlined above. Unlike other types of protected health information, SUD records may expose a patient to criminal liability or other negative legal consequences that HIPAA does not protect against.

// HIPAA allows disclosures of SUD treatment information to health plans without the patient’s consent – including those entities with collections, fundraising, consumer reporting, and underwriting functions.

This means that that people undergoing alcohol and/or drug treatment may be more likely to lose health insurance or even their employment. Part 2 requires client consent authorizing disclosure of SUD records for treatment, payment, or healthcare operations.

// Unlike Part 2, HIPAA provides no meaningful protections against civil litigants obtaining SUD treatment information for use in court proceedings, which means that patients in the process of divorce or child custody proceedings are more likely to lose legal custody of their children, even if they are doing well in treatment.

// Under HIPAA, anyone who receives confidential SUD information, even with the patient’s written consent, could re-disclose the information to others without the patient’s knowledge or permission. This re-disclosed data could cause the client to experience unnecessary stigma and negative consequences, such as loss of employment, incarceration, and/or loss of housing.

Part 2 was designed to protect information that identifies a person as an SUD patient. As a result, it provides greater protection, support, and motivation for individuals to seek out and stay in alcohol or drug treatment.

Why is 42 CFR Part 2 important for SUD treatment?

People living with SUDs continue to experience stigma, discrimination, and serious negative consequences when treatment information is disclosed without their knowledge or consent. These consequences include arrest, prosecution, and incarceration, as well as loss of housing, child custody, employment, insurance, and public benefits.

It’s not surprising, then, that many people report that confidentiality is one of their top concerns before entering treatment for SUDs. Public health experts agree that people living with SUDs are more likely to seek out – and stay in – treatment if they can trust that their treatment records will be protected.

In light of the current national opioid crisis, now more than ever – people living with SUDs depend on Part 2’s protections to stay and complete their treatment without fear of negative consequences.

How Does PIMSY Support CFR Part 2?

Leigh-Ann Renz

Leigh-Ann Renz is the Marketing & Business Development Director of PIMSY EHR. For more information about electronic solutions for your practice, check out Mental Health EHR.