Does your organization provide substance use treatment services or receive information from a treatment program that identifies an individual as having a substance use disorder? If so, your organization may be subject to 42 C.F.R. Part 2 and may have obligations to amend contractual provisions to maintain compliance.
42 C.F.R. Part 2 imposes requirements on “Part 2 Programs” regarding the privacy and security of information that identifies a patient as being or having been diagnosed with a substance use disorder, having or having had a substance use disorder, or being or having been referred for treatment of a substance use disorder. A Part 2 Program is a federally assisted individual or entity that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment, including identified units within a general medical facility or personnel or staff within a general medical facility whose primary function relates to substance use disorders.
Unlike HIPAA and other privacy laws, 42 C.F.R. Part 2 has limited situations in which information can be shared without the consent of the patient. A specific written authorization is even required to share information between healthcare providers and to submit claims to insurance. Further, unlike HIPAA and other privacy laws, the obligations of 42 C.F.R. Part 2 remain with the information and transfer to the recipient of the information, who becomes a “Lawful Holder” under the law. Like Part 2 Programs, Lawful Holders have obligations to protect the information and obtain consent for further disclosure. Part 2 Programs and Lawful Holders also have obligations to identify the information as subject to 42 C.F.R. Part 2 by adding a tag line to the information whenever it is disclosed.
The requirements under 42 C.F.R. Part 2 were revised last year to incorporate a contractor or legal representative concept. Under this concept, a Lawful Holder of patient identifying information, can share this information with a contractor who provides services to the Lawful Holder without obtaining additional consent from the patient, so long as 1) the original consent allows disclosure of the information for payment and health care operations activities and 2) the Lawful Holder has a written agreement in place with the contractor that satisfies certain requirements. The compliance date for these additional contractual requirements is February 2, 2020, making 2019 the perfect time to revise agreements and incorporate these terms where necessary.
To ensure compliance with 42 C.F.R. Part 2, every organization should be considering:
- Is our organization a Part 2 Program or do we receive identifiable patient information from a Part 2 Program as a Lawful Holder? Or are we a service provider who contracts with a Part 2 Program or Lawful Holder?
- Have we implemented necessary protections and operational processes to protect information subject to 42 C.F.R Part 2?
- Does our consent process utilize language that allows disclosure of information to contractors?
- Have we incorporated necessary contractual provisions into our agreements to allow disclosure of identifiable patient information to our contractors or to receive the information as a contractor?
This blog post was drafted by Stacy Harper, a Partner in the Overland Park, KS office of Spencer Fane LLP. For more information, visit spencerfane.com.
