Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 1
Disclosure of Substance Use Disorder Patient Records:
How Do I Exchange Part 2 Data?
Title 42 of the Code of Federal Regulations (CFR) Part 2: Confidentiality of Substance Use
Disorder Patient Records (Part 2) was first promulgated in 1975 to address concerns about the
potential use of Substance Use Disorder (SUD) information in non-treatment based settings such as
administrative or criminal hearings related to the patient. Part 2 is intended to ensure that a patient
receiving treatment for a SUD in a Part 2 Program does not face adverse consequences in relation to
issues such as criminal proceedings and domestic proceedings such as those related to child custody,
divorce or employment. Part 2 protects the confidentiality of SUD patient records by restricting the
circumstances under which Part 2 Programs or other lawful holders
1
can disclose such records.
Part 2 Programs are federally assisted
2
programs.
3
In general, Part 2 Programs are prohibited from
disclosing any information that would identify a person as having or having had a SUD unless that
person provides written consent. Part 2 specifies a set of requirements for consent forms, including but
not limited to the name of the patient, the names of individuals/entities that are permitted to disclose
or receive patient identifying information, the amount and kind of the information being disclosed, and
the purpose of the disclosure (see §2.31).
4
In addition to Part 2, other privacy laws such as the Health
Insurance Portability and Accountability Act of 1996 (HIPAA)
5
have been enacted. HIPAA generally
permits the disclosure of protected health information for certain purposes without patient
authorization, including treatment, payment, or health care operations.
To help stakeholders understand their rights and obligations under Part 2, the Office of the National
Coordinator for Health Information Technology (ONC) and the Substance Abuse and Mental Health
Services Administration (SAMHSA) have released two fact sheets illustrating how Part 2 might apply
in various settings. This fact sheet demonstrates how Part 2 applies to the electronic exchange of
health
1
A “lawful holder” is an individual or entity who has received patient identifying information as the result of a part
2-compliant consent or as otherwise permitted under the part 2 statute, regulations, or guidance.
2
“Federally assisted” (defined at § 2.12 (b)) encompasses a broad set of activities, including management by a
federal office or agency, receipt of any federal funding, or registration to dispense controlled substances related to
the treatment of SUDs. Many SUD treatment programs are federally assisted.
3
A “program” (defined at § 2.11) is an individual, entity (other than a general medical facility), or an identified unit
in a general medical facility, that “holds itself out” as providing and provides diagnosis, treatment, or referral for
treatment for a SUD. Medical personnel or other staff in a general medical facility who are identified as providers
whose primary function is to provide diagnosis, treatment, or referral for treatment for a SUD are also Programs.
“Holds itself out” means any activity that would lead one to reasonably conclude that the individual or entity
provides substance use disorder diagnosis, treatment, or referral for treatment.
4
A full description of the requirements of a Part 2 consent form is available at:
https://www.gpo.gov/fdsys/pkg/FR-2017-01-18/pdf/2017-00719.pdf.
5
State laws and regulations may also further restrict the disclosure of substance use disorder patient records.
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet
is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information
contained herein.
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet
is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information
contained herein.
Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 2
care records with a Part 2 Program. The fact sheet presents health information exchange scenarios and
illustrates how Part 2 applies to a theoretical disclosure of patient health information in each scenario.
6
HEALTH INFORMATION EXCHANGE
Electronic health information exchange allows doctors, nurses, pharmacists, other health care providers,
and patients to appropriately access and securely share an individual’s health information—improving
the speed, quality, safety, and cost of patient care. Health information exchange can greatly improve the
completeness of patient records, which in turn contributes to more informed decision-making at the
point of care. Two common types of health information exchange include directed exchange and query-
based exchange.
DIRECTED EXCHANGE
Directed exchange enables health care providers to securely send/receive patient information—such as
laboratory orders and results, patient referrals, or discharge summaries— via the internet to/from a
known and trusted recipient. Common forms of directed exchange include Direct Secure Messaging
(commonly compared to secure email for healthcare), point-to-point interfaces between systems, and
web services.
In
the directed exchange scenario, Dr. Washington is an addiction counselor at Memorial Treatment
Center, a SAMHSA-certified Opioid Treatment Program that provides medication-assisted treatment
(MAT) for persons diagnosed with an opioid use disorder. One of Dr. Washington’s patients is Thomas.
6
Note: All scenarios described in this fact sheet involve adult patients. Part 2 includes specific provisions for minor
patients (see § 2.14) that are not presented in this fact sheet.
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet
is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information
contained herein.
Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 3
Thomas was recently referred to Memorial Treatment Center by his primary care provider, Dr. Adams.
After entering Memorial’s treatment program, Thomas noted that he wants Dr. Adams to know about
his treatment at Memorial Treatment Center.
To meet the requirements of Part 2, Dr. Washington has Thomas complete a consent form specifying
that he would like progress notes related to his treatment for SUD sent from Memorial Treatment
Center to Dr. Adams. After each appointment, Dr. Washington uses his electronic health record (EHR)
system to create a direct message and send the progress notes to Dr. Adams, who receives the message
in her EHR system.
QUERY-BASED EXCHANGE
Query-based exchange enables health care providers to search clinical data sources and discover
information about a patient. Query-based exchange typically involves an intermediary, often known as a
health information exchange (HIE). The HIE either maintains a centralized data repository that includes
data from connected systems, or facilitates requests from one system to search another system.
In the query-based exchange scenario, Monument Community Mental Health Center (Monument)
provides a variety of behavioral health services to patients, including treatment for SUDs. Monument
describes these services on its website and through advertisements. Dr. Madison is a psychiatrist at
Monument who specializes in addiction treatment and counseling and provides MAT to patients with a
SUD. Monument recently joined a local HIE and wants to share patient records with the HIE so that
other providers can access information about the behavioral health care of their patients.
As a Part 2 Program, Monument would need to meet the requirements of Part 2 before disclosing
patient records to the HIE. To meet the requirements of Part 2, Monument must either obtain patient
consent before disclosing Part 2 patient-identifying information to the HIE or execute a Qualified Service
Organization Agreement (QSOA) with the HIE (see § 2.11 and § 2.12(c)(4)).
Query-Based Exchange Scenario 1: Written QSOA with an HIE
A qualified service organization is an individual or entity who:
(1)
Pr
ovides services to a Part 2 Program, such as data processing, bill collecting, dosage
preparation, laboratory analyses, legal, accounting, population health management, medical
staffing, or other professional services, and
(2
) H
as entered into a written agreement with a Part 2 Program under which the QSO:
(i) Acknowledges that in receiving, storing, processing, or otherwise dealing with any patient
records from the Part 2 Program, it is fully bound by 42 CFR Part 2; and
(ii)
I
f necessary, will resist in judicial proceedings any efforts to obtain access to patient-
identifying information related to substance use disorder diagnosis, treatment, or
referral for treatment except as permitted by 42 CFR Part 2.
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet
is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information
contained herein.
Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 4
Monument and the HIE could sign a QSOA acknowledging that the HIE is providing information exchange
services to Monument and is bound by the requirements of Part 2. Because the HIE is considered a QSO,
Part 2 Programs at Monument would not need patient consent to disclose patient information to the
HIE. However, providers participating in the HIE would need Thomas’s consent to view his SUD patient
records. The HIE would be restricted from re-disclosing patient identifying information to participating
providers without Thomas’s consent.
In
the figure above, Thomas grants consent for Dr. Madison to share his SUD records with Dr. Monroe, a
provider participating in a local HIE. Dr. Madison can send Thomas’s records to the HIE without his
consent because the HIE has a QSOA with Monument. Dr. Monroe can access Thomas’s SUD records
through the HIE because he was named on Thomas’s consent form. However, other providers
participating in the HIE could not access Thomas’s records because they were not listed on the consent
form.
Query-Based Exchange Scenario 2: Patient Consent Forms
If Monument and the HIE did not sign a QSOA, Dr. Madison could have her patients fill out a consent
form to disclose their SUD treatment records to other health care providers through the HIE. Health care
providers listed on the patient’s consent form could access the HIE to view the patient’s records. The
consent form would need to include the name of the HIE, as well as the (1) name of a specific individual
and/or organization participating in the HIE, or (2) a general designation of individuals/entities that have
a treating provider relationship with the patient. The consent form would also have to fulfill all other
requirements as specified by Part 2.
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet
is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information
contained herein.
Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 5
If a p
atient used a general designation, the consent form would also have to include a notice stating that
the patient understands that upon written request, he/she must be provided with a list of entities to
which his/her information has been disclosed within the past two years. The HIE would be responsible
for responding to the request within 30 days. For each disclosure, the HIE would have to include the
name(s) of the entities to which the disclosure was made, the date of the disclosure, and a brief
description of the patient-identifying information that was disclosed.
Additional Resources
• 42 CFR Part 2 [PDF - 556 KB]
• SAMHSA’s webpage about 42 CFR Part 2
