Since the 1970s, the Federal Government has required that the medical records of patients who receive treatment for substance use disorder (SUD) be given extra protections to ensure confidentiality.  These federal rules – commonly known as 42 CFR Part 2 – have recently been revised, and are more extensive than the standard protections required under HIPAA.  Given the Health Resources and Services Administration’s (HRSA)  recent announcement of the availability of funds to expand access to substance use disorder (SUD) and mental health services, health centers are reportedly concerned about complying with the revised confidentiality rules that impact medical records for SUD treatment.

First, health centers should note that the 42 CFR Part 2 rules do not apply to all SUD records; rather, whether they apply depends on the characteristics of the health care provider who provided the SUD services.  In general terms, only records generated by providers who are publicly identified as offering SUD treatment services are subject to 42 CFR Part 2.  According to the final rule issued in January 2017, health center providers generally are not subject to these requirements, as they are viewed as providing “general medical care.”

However, there are two important exceptions:  health center providers (and the SUD treatment records they generate) are subject to 42 CFR rules if the provider meets either of the following criteria:

• They “work in an identified unit within [the health center] that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment”

OR

• “the primary function of the provider is substance use disorder diagnosis, treatment or referral for treatment and they are identified as providers of such services.”

In other words, if a health center provider is publicly identifiable as a provider of SUD services, either by the unit they work in or individually, then the medical records they generate are subject to the 42 CFR protections.  This means these providers are required to obtain patient consent before sharing information about SUD diagnosis and treatment.  Click here for more information on which health center providers are subject to 42 CFR Part 2.

The 42 CFR requirements can complicate efforts to coordinate care for patients who are dealing with SUD.  To help address those problems, the recent revisions made some simplifications to the consent process; for example, patients can now consent to sharing with their records with all providers within a specified group, as opposed to having to name each provider individually.  In addition, some states and providers are adopting innovative approaches to support ensuring care coordination while maintaining appropriate confidentiality.  For example, see this case study of how a community has implemented a standard consent form.  More information on coordinating care for patients with SUD while adhering to 42 CFR protections is available from the HRSA/ SAMSHA Center for Integrated Health Solutions.

This project was supported by the Health Resources and Services Administration (HRSA) of the U.S. Department of Health and Human Services (HHS) under cooperative agreement number U30CS16089, Technical Assistance to Community and Migrant Health Centers and Homeless for $6,375,000.00. This information or content and conclusions are those of the author and should not be construed as the official position or policy of, nor should any endorsements be inferred by HRSA, HHS or the U.S. Government.