NRPM: Standards for Privacy of Individually Identifiable Health Information. b. The Substance Abuse Confidentiality regulations.


Regulations that are codified at 42 CFR part 2 establish confidentiality requirements for the patient records of substance abuse “programs” that are “federally assisted.” Substance abuse programs are specialized programs or personnel that provide alcohol and drug abuse treatment, diagnosis, or referral for treatment. 42 CFR 2.11. The term “federally assisted” is broadly defined, and includes federal tax exempt status and Medicare certification, among other criteria. 42 CFR 2.12(b). Such programs may not disclose patient identifying information without the written consent of the patient, unless the information is needed to respond to a medical emergency, or such information is disclosed for purposes of research, audit, or evaluation. Disclosures may not be made in response to a subpoena; rather, a court order is required in order for a disclosure of covered records to be lawfully made. Limited disclosures may also be made by such programs to State or local officials under a State law requiring reporting of incidents of suspected child abuse and neglect and to law enforcement officials regarding a patient’s crime on program premises or against program personnel or a threat to commit such a crime. 42 CFR 2.12. Unlike the rules proposed below, the confidentiality protections continue indefinitely after death, although part 2 would permit disclosure of identifying information relating to the cause of death under laws relating to the collection of vital statistics or permitting inquiry into cause of death.

It seems likely that most, if not all, programs covered by the part 2 regulations will also be covered, as health care providers, by the rules proposed below. As can be seen from the above summary, the part 2 regulations would not permit many disclosures that would be permitted under proposed § 164.510 below, such as many disclosures for law enforcement, directory information, governmental health data systems, and judicial and other purposes. In addition, the general permissive disclosure for treatment or payment purposes at proposed § 164.506 below would be inconsistent with the more restrictive requirements at part 2. In such situations, providers (or others) subject to both sets of requirements could not make disclosures prohibited by part 2, even if the same disclosures would be permitted under the rules proposed below.

There are also a number of requirements of the part 2 regulations that parallel the requirements proposed below. For example, the minimum necessary rule, where applicable, would parallel a similar requirement at 42 CFR 2.13(a). Similarly, the notice requirements of part 2, at 42 CFR 2.22 parallel the notice requirements proposed below, although the notice required below would be more detailed and cover more issues. The preemptive effect on State law should be the same under both part 2 and section 264(c)(2). The requirements for disclosures for research proposed below are likewise similar to those in part 2. In such cases, health care providers would have to comply with the more extensive or detailed requirements, but there should be no direct conflict.

Many other provisions of the proposed rules, however, simply have no counterpart in part 2. For example, the part 2 regulations do not require programs to maintain an accounting of uses and disclosures, nor do they provide for a right to request amendment or correction of patient information. Similarly, the part 2 regulations contain no prohibition on conditioning treatment or payment on provision of an individual authorization for disclosure. In such situations, health care providers would be bound by both sets of requirements.