Dedicated to helping health professionals.

Ten Things to Know About the Privacy of Substance Abuse Treatment Records

by Laura A. Perkovic

Health care providers are well aware of their obligations under HIPAA to safeguard protected health information. However, many providers may not be aware that alcohol and drug abuse treatment records are afforded an extra level of protection under federal laws found at 42 C.F.R. Part 2. Here are ten things to know about the security of substance abuse treatment records.

1) What kinds of records are protected?

Records having special protection are those containing:

  • The identity, prognosis, or treatment;
  • Of any patient;
  • Originating from a practitioner or facility;
  • That holds itself out as providing, and does provide;
  • Alcohol or drug abuse diagnosis, treatment or referral for treatment;
  • And the practitioner or facility is regulated or assisted by the federal government.

This may include a primary care doctor who holds herself out as providing alcohol or drug abuse treatment as part of a general practice. Also, this may include an identified unit within a hospital or multi-specialty practice that has a primary function of providing substance abuse diagnosis, treatment, or referral. Such providers must protect such records apart from the remaining practice. However, the regulations would not apply to records of an emergency department referral to the ICU for care related to a drug overdose, unless the emergency department specifically holds itself out to the community as a provider of substance abuse treatment services.

A program is federally assisted if:

  1. It is carried out under license, certification, or registration granted by any agency of the United States such as DEA, Medicare, etc.;
  2. It is conducted directly or by contract with the federal government;
  3. It is supported by federal funds directly or through payment for services;
  4. It is allowed income tax deductions for contributions to the program, or has been granted tax exempt status.

Alcohol abuse is defined as “the use of an alcoholic beverage which impairs the physical, mental, emotional, or social well-being of the user.” Drug abuse means the use of a psychoactive substance for other than medicinal purposes which impairs the physical, mental, emotional, or social well-being of the user. In addition to those substances that first come to mind, be aware that smoking cessation records may also fall under the gamut of this law. The Centers for Disease Control and Prevention consider nicotine as a psychoactive substance.

2) Who must maintain the confidentiality of these records?

Substance abuse treatment providers as well as those in the chain of possession of such records are obligated to limit disclosures. This includes third party payors, governmental and private entities with oversight over the programs, and any other person who receives records directly from one of these programs and are notified of the restrictions on re-disclosure.

3) What are the requirements for the safekeeping of these records?

Written records must be secured. For example, they may be maintained in a secure room, locked file cabinet, safe, or other similar container when not in use. Also, every treatment program or facility must adopt written procedures regulating the control and access to such written records.

4) May a provider release records in a medical emergency?

Yes. Patient identifying information may be disclosed for the purpose of treating a condition which “poses an immediate threat to the health of any individual and which requires immediate medical intervention.” Such disclosures must be documented in accordance with specified procedures.

5) May a provider disclose records with consent of the patient?

Generally, yes. Special rules apply to disclosures made to central registries and criminal justice referrals (court-ordered treatment). Also, signed releases must meet certain requirements.

6) Will my standard HIPAA release and notice of privacy practices suffice?

HIPAA-compliant releases should cover most requirements, except substance abuse provider releases must also contain specific language regarding the prohibition on re-disclosure.

Likewise, HIPAA-compliant notices of privacy practices cover most but not all requirements. There are additional required contents of notices to patients regarding the confidentiality of their substance abuse treatment records.

7) May a provider disclose substance abuse treatment records to law enforcement pursuant to a subpoena or court order?

Both are necessary. The requestor needs both, (1) permission to access the records; and (2) legal authority to compel the provider to disclose the records. A court order merely gives the holder of records permission to make the disclosure without violating. 42 C.F.R. part 2. The requestor also needs a valid legal mechanism to compel the provider to turn over the records, such as an investigative subpoena or warrant in the case of a criminal investigation. Additionally, a court order must specifically state whether a provider may disclose “confidential communications” which are not the same as other portions of the patient record. This is a tricky confluence of laws and regulations, requiring consultation of an experienced health care attorney.

8) May a provider disclose substance abuse treatment records as part of a Medicaid program audit?

Yes. Providers may disclose records without patient consent, and without court order and subpoena, in compliance with certain audit and oversight activities, as well as Medicaid or Medicare civil and administrative investigations.  However, if records are copied or removed, the person receiving records must state in writing that they:

  1. Are performing the audit or evaluation activity on behalf of a governmental agency providing financial assistance to that program or authorized to regulate its activities; or pursuant to other specific legal authority;
  2. Shall maintain the records in accordance with the security requirements of these regulations;
  3. Shall destroy all patient identifying information at the completion of the audit;
  4. Shall comply with re-disclosure requirements.

9) If a disclosure is authorized, what parts of the patient record may be disclosed?

Disclosures must be limited to that information necessary to carry out the purpose of the disclosure. This is commonly known as the “minimum necessary” rule.

Context is important. As mentioned above, in the context of a court order, disclosures cannot include “confidential communications” unless the order specifically allows it.

10) What are the penalties for violating substance abuse records privacy laws?

There are criminal penalties for violations of 42 C.F.R. Part 2. A first offense is subject to a fine up to $500. Subsequent offenses are subject to fines up to $5,000.