- This fact sheet explains a 42 CFR Part 2 Program and how healthcare providers can determine how Part 2 applies to them.
- This fact sheet describes how 42 CFR Part 2 applies to the electronic exchange of healthcare records with a Part 2 Program.
Applying the Substance Abuse Confidentiality Regulations
Substance Abuse and Mental Health Services Administration
U.S. Department of Health and Human Services
42 CFR Part 2 (REVISED)
These Frequently Asked Questions (FAQs) are for information purposes only and are not intended as legal advice. Specific questions regarding compliance with federal law should be referred to your legal counsel. State laws may also apply.
In 2010, the HHS Substance Abuse and Mental Health Services Administration (SAMHSA) and the HHS Office of the National Coordinator (ONC) published FAQs “Applying the Substance Abuse Confidentiality Regulations to Health Information Exchange (HIE).” The 2010 FAQs are available at Applying the Substance Abuse Confidentiality Regulations to Health Information Exchange (HIE) (PDF | 381 KB).
QUESTION 1
When a patient has signed a consent form allowing disclosure to multiple parties, can the patient revoke consent for disclosure to one or more of those parties while leaving the rest of the consent in force?
Yes. Under 42 CFR Part 2 (hereafter referred to as “Part 2”), a patient can revoke consent to one or more parties named in a multi-party consent form while leaving the rest of the consent in effect. In a non-Health Information Exchange (HIE) environment, this can be accomplished simply by the Part 2 program indicating on the consent form or in the patient’s record that consent has been revoked with respect to one or more named parties. In an HIE environment, the revocation with respect to one or more parties should be clearly communicated to the Health Information Organization (HIO) as well as noted in the patient’s record by the Part 2 program.
NOTES: Health Information Exchange (“HIE”) is a generic term that refers to a number of methods and mechanisms through which information can be exchanged electronically. As used in these FAQs, the term Health Information Organization “HIO” means an organization that oversees and governs the exchange of health-related information among organizations according to nationally recognized standards.
To ensure compliance with consent requirements, an HIO should have policies and procedures in place for implementing patient decisions to give and revoke consent. Once a patient has revoked a Part 2 consent with respect to one or more parties, that revocation should be immediately communicated to the HIO by the entity obtaining the patient’s revocation so that it implements the revocation decision and no longer transmits the Part 2 program’s protected patient information to those one or more parties. Part 2 permits a patient to revoke consent orally [42 CFR §2.31(a)(8),(c)(8)]. While oral revocations must be honored under Part 2, SAMHSA recommends the entity obtaining the revocation get it in writing and/or document the revocation in the patient’s record. Part 2 prohibits a program from making a disclosure on the basis of a consent which it knows has been revoked. A program however is entitled to act in reliance on a signed consent prior to a revocation, and such disclosure would not be improper [42 CFR § 2.31(c)(3) and § 2.31(a)(8)]. SAMHSA recommends that a revocation be communicated as soon as practicable to entities relying on such consent.
We note that the requirements of the HIPAA Privacy Rule must also be considered. For information on HIPAA (PDF | 379 KB), see the HHS Health Information Privacy website.
QUESTION 2
Does a consent form allowing for a program to disclose Part 2 information remain in effect when the disclosing program merges with another or undergoes corporate restructuring?
Whether a consent form remains in effect when a program merges with another program or undergoes corporate restructuring depends on how the entity making the disclosure is identified on the consent form.
Under Section 2.31(a)(1), the disclosing entity can be listed by “specific name or general designation.” If a particular program is designated by specific name as the entity permitted to make the disclosure, then the consent form would no longer be valid if the program’s name is changed (following a merger or restructuring or for another reason) since the new entity is not identified as the same one that was listed on the consent form. If the disclosing entity is listed by a general designation, such as “any drug or alcohol treatment program that is affiliated with the XYZ HIO,” then that consent would continue to be valid if the program making the disclosure merges or undergoes corporate restructuring, assuming the new merged program is also an HIO-affiliated member.
Note that section 2.19 sets forth the requirements when a Part 2 program is discontinued or taken over or acquired by another program, as opposed to just undergoing a name change or restructuring. This section provides that a discontinued program or one acquired by another program must purge patient identifying information from its records or destroy the records unless the patient consents to the transfer of his or her records, except to the extent that there is a legal requirement that records be retained.
In cases where a recipient organization has undergone a name change, whether or not a new consent form is needed depends upon the specific designation made on the original consent. Section 2.31(a)(2) allows for specification of either the name or title of the individual or the name or the organization to which the disclosure is to be made. Therefore, an organizational name change alone may not necessitate a new consent.
QUESTION 3
May a Part 2 program disclose patient information to providers of “on-call coverage” pursuant to a Qualified Service Organization Agreement (QSOA)?
Yes. 42 CFR § 2.11 defines “Qualified Service Organization (QSO)” and lists the types of services that a QSO provides, and further references Qualified Service Organization Agreements (QSOA). Medical services are included on that list and thus a Part 2 program can enter into a QSOA with providers of “on-call coverage.”
A QSOA is a two-way agreement between a Part 2 program and the entity providing the service, in this case the provider of on-call coverage. The QSOA authorizes communication between those two parties, however the Part 2 program should only disclose information to the QSO that is necessary for the QSO to perform its duties under the QSOA. Also, the QSOA does not permit a QSO to redisclose information to a third party unless that third party is a contract agent of the QSO, helping them provide services described in the QSOA, and only as long as the agent only further discloses the information back to the QSO or to the Part 2 program from which the information originated. For additional information, see FAQ Number 10 of the 2010 FAQs published by SAMHSA and the ONC at: Applying the Substance Abuse Confidentiality Regulations to Health Information Exchange (HIE) (PDF | 381 KB).
Thus, if a QSOA exists between a Part 2 program and an HIO for services rendered to the program by the HIO, the QSOA would not allow the HIO to redisclose that information to a third party like providers of “on-call coverage.” For an HIO to redisclose Part 2 information to providers of “on-call coverage” that are not part of the Part 2 program, a consent form that allows the HIO to make the redisclosures to the providers of “on-call coverage” would be needed.
Since “on-call coverage” arrangements are fluid and the identity of the health care provider who is providing the on-call coverage might not be known, the designation of the recipient could be “the health care provider who is providing on-call coverage for the ABC treatment program.” By designating the recipient as the “on-call coverage provider,” the requirement that the recipient’s name or title be listed would be met. Consent for disclosures to providers of on-call coverage can be included in the same consent form used for other disclosures of patient information if the program so chooses.
An HIO can also redisclose Part 2 information without patient consent to providers of “on-call coverage” who are part of the Part 2 program or of an entity having direct administrative control over the program, as long as the on-call providers need the information in connection with their duties that arise out the provision of diagnosis, treatment or referral for treatment services [42 CFR § 2.12(c)(3)].
QUESTION 4
Can a single Part 2 consent form be used to authorize patient information to be exchanged through an HIO’s system for different purposes, such as treatment, payment, disease management and/or quality improvement?
Yes. Part 2 allows the use of a single consent form authorizing the disclosure of Part 2 patient information to different recipients for different purposes. However, Part 2 also requires a consent form to specify the kind and amount of information that can be disclosed to each of the recipients named in the consent. The amount of information to be disclosed “must be limited to that information which is necessary to carry out the purpose of the disclosure” [42 C.F.R. §2.13(a)]. This will vary depending on the different purposes for which different recipients are being allowed access to the information made available through an HIE. Thus the consent form would have to be structured to make it clear what information may be given to which recipients, and for which purposes. The HIE system must also be designed to limit the different recipients’ access through the HIE to only the kind and amount of patient information each needs to fulfill the specific purpose for which they are being allowed access.
QUESTION 5
Does Part 2 permit a healthcare provider to disclose information without consent when there is an immediate threat to the health or safety of an individual or the public?
Part 2 permits the disclosure of information under certain circumstances without consent during a medical emergency or in other limited situations. If a Part 2 program (or a healthcare provider that has received Part 2 patient information) believes that there is an immediate threat to the health or safety of any individual, there are steps described below that the Part 2 program or healthcare provider can take in such a situation:
Notifications to medical personnel in a medical emergency: A Part 2 program can make disclosures to medical personnel if there is a determination that a medical emergency exists, i.e., there is a situation that poses an immediate threat to the health of any individual and requires immediate medical intervention [42 CFR §2.51(a)]. Information disclosed to the medical personnel who are treating such a medical emergency may be redisclosed by such personnel for treatment purposes as needed. For additional information regarding disclosures during a medical emergency, see FAQs Numbered 7, 8, and 9 below.
Notifications to law enforcement: Law enforcement agencies can be notified if an immediate threat to the health or safety of an individual exists due to a crime on program premises or against program personnel. A Part 2 program is permitted to report the crime or attempted crime to a law enforcement agency or to seek its assistance [42 CFR §2.12(c)(5)]. Part 2 permits a program to disclose information regarding the circumstances of such incident, including the suspect’s name, address, last known whereabouts, and status as a patient in the program.
Immediate threats to health or safety that do not involve medical emergencies or crimes on programs premises or against program personnel: Part 2 programs and health care providers and HIOs who have received Part 2 patient information, can make reports to law enforcement about an immediate threat to the health or safety of an individual or the public if patient-identifying information is not disclosed. Immediate threats to health or safety that do not involve a medical emergency or crimes (e.g., a fire) are not addressed in the regulations. Programs should evaluate those circumstances individually.
Reports of child abuse and neglect: The restrictions on disclosure do not apply to the reporting under State law of incidents of suspected child abuse and neglect to the appropriate State or local authorities. However, Part 2 restrictions continue to apply to the original alcohol or drug abuse patient records maintained by the program including their disclosure and use for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect [42 CFR § 2.12(c)(6)]. Also, a court order under Part 2 may authorize disclosure of confidential communications made by a patient to a program in the course of diagnosis, treatment, or referral for treatment if, among other reasons, the disclosure is necessary to protect against an existing threat of life or of serious bodily injury, including circumstances which constitute suspected child abuse and neglect [42 CFR § 2.63(a)(1)].
Court ordered disclosures: Under the regulations, Part 2 programs or “any person having a legally recognized interest in the disclosure which is sought” may apply to a court for an order authorizing disclosure of protected patient information [42 CFR § 2.64]. Thus, if there is an existing threat to life or serious bodily injury, a Part 2 program or “any person having a legally recognized interest in the disclosure which is sought” can apply for a court order to disclose information.
QUESTION 6
Under what circumstances can information disclosed pursuant to Part 2 be redisclosed?
Once Part 2 information has been initially disclosed (with or without patient consent), no redisclosure is permitted without the patient’s express consent to redisclose or unless otherwise permitted under Part 2.
Disclosures made with patient consent must be accompanied by a statement notifying the recipient that Part 2 redisclosure is prohibited, unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by Part 2 (42 CFR § 2.32).
When disclosures are made without patient consent under the following circumstances, limited redisclosures without obtaining the patient’s consent: are permitted, such as medical emergencies [42 CFR § 2.51], child abuse reporting [42 CFR § 2.12(c)(6)], crimes on program premises or against program personnel [42 CFR § 2.12(c)(5)], and court ordered disclosures when procedures and criteria are met [42 CFR §§ 2.61-2.67].
When disclosures are made under the following circumstances the recipient is prohibited from redisclosing the information without consent, except under the following restricted circumstances:
Research: Researchers who receive patient identifying information are prohibited from redisclosing the patient-identifying information to anyone except back to the program [42 CFR § 2.52(b)].
Audits and Evaluations: Part 2 permits disclosures to persons and organizations authorized to conduct audits and evaluation activities, but imposes limitations by requiring any person or organization conducting the audit or evaluation to agree in writing that it will redisclose patient identifying information only (1) back to the program, or (2) pursuant to a court order to investigate or prosecute the program (not a patient), or (3) to a government agency that is overseeing a Medicare or Medicaid audit or evaluation [42 CFR § 2.53(c)(d)].
Qualified Service Organization Agreements (QSOAs): Part 2 requires the QSO to agree in writing that in receiving, storing, processing, or otherwise dealing with any information from the program about patients, it is fully bound by Part 2, it will resist, in judicial proceedings if necessary, any efforts to obtain access to information pertaining to patients except as permitted by Part 2, and will use appropriate safeguards to prevent the unauthorized use or disclosure of the protected information [42 CFR § 2.11]. In addition, QSOAs may allow disclosure in certain circumstances.
Authorizing Court Orders: When information is disclosed pursuant to an authorizing court order, Part 2 requires that steps be taken to protect patient confidentiality. In a civil case, Part 2 requires that the court order authorizing a disclosure include measures necessary to limit disclosure for the patient’s protection, which could include sealing from public scrutiny the record of any proceeding for which disclosure of a patient’s record has been ordered [42 CFR § 2.64(e)(3)]. In a criminal case, such order must limit disclosure to those law enforcement and prosecutorial officials who are responsible for or are conducting the investigation or prosecution, and must limit their use of the record to cases involving extremely serious crimes or suspected crimes. For additional information regarding the contents of court orders authorizing disclosure, see 42 CFR § 2.65(e).
QUESTION 7
How can a Part 2 program ensure that it will be notified that a health care provider invoked the medical emergency exception and gained access to protected Part 2 information?
The Part 2 regulations at 42 CFR §2.51 specify that when a disclosure is made in connection with a medical emergency, the Part 2 program must document in the patient's record the name and affiliation of the recipient of the information, the name of the individual making the disclosure, the date and time of the disclosure, and the nature of the emergency [42 CFR § 2.51(c)]. See previous FAQs, and specifically, Number 30 of the 2010 FAQs. SAMHSA recommends that HIE data systems be designed to ensure that the Part 2 program is notified when a disclosure occurs and Part 2 records are released pursuant to a medical emergency. To promote compliance, SAMHSA recommends that the notification include all the information that the Part 2 program is required to document in the patient’s records (e.g., date and time of disclosure, the nature of the emergency, etc.). Similarly, SAMHSA recommends that the information about emergency disclosures be kept in the HIO’s electronic system and protected using appropriate safeguards.
Before a Part 2 program enters into an affiliation with an HIO, it should consider whether the HIO system has the capability to comply with all Part 2 requirements, including the capacity to notify the Part 2 program when its records have been disclosed pursuant to a medical emergency. For additional information regarding disclosures during a medical emergency, see the FAQs Numbered 5, 8, and 9.
QUESTION 8
What categories of health care professionals are considered “medical personnel” for the purpose of obtaining information during a medical emergency?
Part 2 allows patient identifying information to be disclosed to medical personnel in a medical emergency [42 CFR § 2.51]. Part 2 does not define the term “medical personnel” but merely provides that information can be given to medical personnel who have a need for information about a patient for the purpose of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention. It is up to the health care provider or facility treating the emergency to determine the existence of a medical emergency and which personnel are needed to address the medical emergency. The name of the medical personnel to whom the disclosure was made, their affiliation with any health care facility, the name of the individual making the disclosure, the date and time of the disclosure, and the nature of the medical emergency must be documented in the patient’s records by the Part 2 program disclosing them [42 CFR §2.51(c)]. Additional information about disclosures in medical emergencies is found in FAQs Numbered 5, 7, and 9.
QUESTION 9
Can the Part 2 medical emergency exception be invoked to head off a potential medical emergency such as a potential drug interaction?
If a health care provider treating an individual determines that a medical emergency exists as defined in Part 2, i.e., “a condition which poses an immediate threat to the health of any individual [not just the patient], and which requires immediate medical intervention,” and in treating the medical emergency the health care provider needs information about potential drug interactions, then that information and any other information contained in the Part 2 record that the treating health care provider determines he or she needs to treat the medical emergency can be disclosed. If no such determination exists, SAMHSA recommends trying to obtain consent from the patient.
If a health care provider is treating a patient in a non-emergency situation and the health care provider is concerned about a potential drug interaction, in an HIE environment, an HIO may only disclose a Part 2 program patient’s records to a health care provider if the patient signs a consent form releasing the Part 2 record to the health care provider. Such a consent form may already exist if the patient previously signed a Part 2 consent form allowing the HIO to disclose Part 2 information to HIO affiliated health care providers and the provider seeking access is listed as a recipient on that form.
A health care provider who is concerned about a potential drug interaction and treating a patient in a non-emergency situation can also gain access to a Part 2 program patient’s record if the health care provider has signed a QSOA with the patient’s Part 2 program (and the information is limited to what is needed for the provider to provide services to the Part 2 program) or obtains patient consent.
In a non-emergency situation, if the health care provider concerned about a potential drug interaction is part of the Part 2 program (or of an entity that has direct administrative control over the program), he or she can gain access to the Part 2 patient’s record without consent if the health care provider needs the information to treat the patient. 42 CFR § 2.12(c)(3) does not restrict communications between and among such personnel who have a need for the information in connection with their duties arising out of the provision of diagnosis, treatment or referral for treatment services.
It should be noted that concern alone about potential drug interaction may not be sufficient to meet the standard of a medical emergency. Thus, based on the circumstances of the presenting situation, SAMHSA recommends that health care providers should obtain consent from the patient where feasible.
QUESTION 10
Do all primary care providers who prescribe controlled substances to treat substance use disorders meet the definition of a “program” under Part 2?
No. Not every primary care provider who prescribes controlled substances meets the definition of a “program” or part of a “program” under Part 2. For providers to be considered “programs” covered by the Part 2 regulations, they must be both ”federally-assisted” and meet the definition of a program under 42 CFR § 2.11. Physicians who prescribe controlled substances to treat substance use disorders are DEA-licensed and thus meet the test for federal assistance [42 CFR § 2.12(b)(2)]. Nevertheless, the regulations establish additional criteria to meet the definition of a “program”:
- If a provider is not a general medical care facility, then the provider meets Part 2’s definition of a “program” if it is an individual or entity that holds itself out as providing, and provides alcohol or drug abuse diagnosis, treatment or referral for treatment.
- If the provider is an identified unit within a general medical care facility, it is a “program” if it holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment.
- If the provider consists of medical personnel or other staff in a general medical care facility, it is a program if its primary function is the provision of alcohol or drug abuse diagnosis, treatment or referral for treatment and is identified as such specialized medical personnel or other staff within the general medical care facility.
In addition, in explaining Part 2’s applicability and coverage, § 2.12(e)(1) states that “coverage includes, but is not limited to, employee assistance programs, programs within general hospitals, school-based programs and private practitioners who hold themselves out as providing, and provide alcohol or drug abuse diagnosis, treatment or referral for treatment” [42 CFR § 2.12(e)(1)].
Accordingly, primary care providers who do not work in general medical care facilities meet Part 2’s definition of a program if their principal practice consists of providing alcohol or drug abuse diagnosis, treatment or referral for treatment, and they hold themselves out as providing the same. If their principal practice consists of providing alcohol or drug abuse diagnosis, treatment or referral for treatment, but they do not hold themselves out as providing those services, then it is likely that they would not meet the definition of a program. The phrase “holds itself out” is not defined in the regulations, but could mean a number of things, including but not limited to state licensing procedures, advertising or the posting of notices in the offices, certifications in addiction medicine, listings in registries, internet statements, consultation activities for non-“program” practitioners, information presented to patients or their families, or any activity that would lead one to reasonably conclude that the provider is providing or provides alcohol or drug abuse diagnosis, treatment or referral for treatment.
Further, while the term “general medical care facility” is not defined in the definitions section of 42 CFR 2.11, hospitals, trauma centers, or federally qualified health centers would generally be considered “general medical care” facilities. Therefore, primary care providers who work in such facilities would only meet Part 2’s definition of a program if 1) they work in an identified unit within such general medical care facility that holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment, or 2) the primary function of the provider is alcohol or drug abuse diagnosis, treatment or referral for treatment and they are identified as providers of such services. In order for a program in a general medical care facility to share information with other parts or units within the general medical care facility, administrative controls must be in place to protect Part 2 information if it is shared.
In addition, a practice comprised of primary care providers could be considered a “general medical facility.” As such, only an identified unit within that general medical care facility which holds itself out as providing and provides alcohol or drug abuse diagnosis, treatment or referral for treatment would be considered a “program” under the definition in the Part 2 regulations. Medical personnel or staff within that facility whose primary function is the provision of those services and who are identified as such providers would also qualify as a “program” under the definition in the Part 2 regulations. Other units or practitioners within that general medical care facility would not meet the definition of a Part 2 program unless such units or practitioners also hold themselves out as providing and provide alcohol or drug abuse diagnosis, treatment or referral for treatment.
QUESTION 11
Is information generated by the provision of SBIRT (Screening, Brief Intervention and Referral to Treatment) services covered by Part 2?
Screening, Brief Intervention and Referral to Treatment (SBIRT) is a cluster of activities designed to identify people who engage in risky substance use or who might meet the criteria for a formal substance use disorder. Clinical findings indicate that the overwhelming majority of individuals screened in a general medical setting do not have a substance use disorder and do not need substance use disorder treatment.
The determination whether patient information acquired when conducting SBIRT services is subject to Part 2 depends on whether the entity conducting the SBIRT activities is a federally-assisted “program” as defined in the regulations. If the entity conducting SBIRT services is not a federally-assisted program, then the SBIRT services and patient records generated by such services would not be covered under 42 CFR Part 2, although HIPAA and state laws may apply. However, if the entity or unit within a general medical care facility conducting the SBIRT services is a federally-assisted program under Part 2, then the SBIRT patient records would be subject to Part 2 regulations.
See FAQ Number 10 of these FAQs for a discussion of the definition of a program under 42 CFR Part 2.
QUESTION 12
What is Part 2’s relationship to State laws?
42 CFR § 2.20, states that “no State law may authorize or compel any disclosure prohibited by these [Part 2] regulations.” However, States may impose additional confidentiality protections. Thus, § 2.20 provides that, “If a disclosure permitted under these regulations is prohibited under State law, neither these regulations nor the authorizing statutes may be construed to authorize any violation of that State law.”
QUESTION 13
Would a logon or splash page notification on an HIO’s portal that conta
DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.
Date Published: 6/16/2020
