42CFR Part 2: Confidentiality of SUD Patients

Title 42 of the Code of Federal Regulations (42CFR) is the principal set of rules regarding public health in the United States. Part 2 deals specifically with the confidentiality of Substance Use Disorder (SUD) patient records.

42CFR Part 2 is up before Congress again this year. The bills (S. 1012/H.R. 2062) would change federal laws on how a patient’s treatment records are shared. Rep. Blumenauer and Sen. Manchin introduced the bills to their respective chambers in early April. Last year’s Congress introduced similar bills that passed the House, but died in the Senate.

42 CFR was enacted in the 1970s and became effective in 1975. It was revised and updated in 1983 and then remained unchanged for more than 30 years. The purpose of the original rule was simple: encourage people to seek substance use disorder treatment while keeping the records of their treatment private. The rule was intended to help people avoid the stigma of receiving SUD treatment and more specifically the rule prohibited the use of patient information for criminal charges or investigation unless there was a substantial risk of death or bodily harm.

When the Health Insurance Portability and Accountability Act of 1996 was enacted (HIPAA) the stage was set for a possible convergence of the two laws. The long unchanged grace period for 42CFR was over. Amendments were made to the rule in 2017 and again in 2018.

The Legal Action Center – with 40 years of advocacy for criminal justice and substance use disorders and offices in both New York and Washington D.C. – does a good job of outlining what the changes mean to treatment providers. The links provided here give a synopsis of what changed and what stayed the same for both 2017 and 2018.

What Substance Use Treatment Providers Should Know – 2018 Amendments
What Substance Use Treatment Providers Should Know – 2017 Amendments

Essentially, the past amendments and the current proposed bills try to align 42CFR Part 2 more with HIPAA, whose requirements are much broader than Part 2. HIPAA may allow disclosures for operations, some treatments, and payments without consent. However, unlike HIPAA, Part 2 requires consent for a specific purpose, places a time limit on consent, places limits on the type of organization for consent, and prohibits re-disclosure.

The controversy most often plays out between institutions and individuals. Various organization, hospitals, insurance companies, and IT companies want to be able to more easily share and use information. Whether the information is for a course of treatment, the exchange of electronic health records, or the payment of invoices, there is a need to get appropriate information. Meanwhile, patient advocates say a patient may not understand the significance of privacy while in the crisis itself. Only when the patient is denied a job, health insurance, disability insurance, or life insurance does the issue become apparent.

On January 2, 2018, SAMHSA released a final rule on the most recent changes and they became effective on February 2, 2018 with this exception: lawful holders of SUD patient records have until February 2, 2020 to ensure that their agreements with contractors, subcontractors, and legal representatives comply with new disclosure requirements.

Read Full SAMHSA Final Rule 2018

One key component of 42CFR Part 2 that has remained unchanged in the past amendments is the requirement for Patient Consent – and that’s what the proposed legislation addresses. What does not change is the rule prohibiting the use of patient information for criminal charges.