CHPC Substance Use Disorder Records (42 CFR Part 2) — Questions and Answers
Question 1: To which entities does 42 CFR Part 2 generally apply?
- Every health care provider that bills Medicare
- Federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment or referral for treatment (Correct answer)
- Only state-run psychiatric hospitals
- All pharmacies that dispense controlled substances
Correct answer: Federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment or referral for treatment
Part 2 applies to federally assisted 'programs' that hold themselves out as providing SUD diagnosis, treatment or referral for treatment. Federal assistance is defined broadly and includes Medicare participation, DEA registration and tax-exempt status. Part 2 also restricts lawful holders who receive Part 2 records.
Question 2: Under the 2024 Part 2 final rule, what change was made to patient consent for treatment, payment and health care operations?
- Consent for TPO was eliminated completely
- A patient may give a single consent for all future uses and disclosures for TPO (Correct answer)
- Consent must now be renewed every 30 days
- Only verbal consent is allowed
Correct answer: A patient may give a single consent for all future uses and disclosures for TPO
The February 2024 final rule allows a single patient consent covering all future TPO uses and disclosures. Recipients that are HIPAA covered entities or business associates may then redisclose the records as HIPAA permits, except for use in proceedings against the patient.
Question 3: Without the patient's specific consent or a qualifying court order, Part 2 records may NOT be used for which purpose?
- Treating the patient in a medical emergency
- Civil, criminal, administrative or legislative proceedings against the patient (Correct answer)
- Internal quality-improvement activities under a TPO consent
- Audits by the program's own compliance department
Correct answer: Civil, criminal, administrative or legislative proceedings against the patient
A key Part 2 protection, kept in the 2024 rule, is that records cannot be used or disclosed to investigate or prosecute the patient, or in proceedings against the patient, without specific consent or a court order that meets Part 2's requirements.
Question 4: Which disclosure of Part 2 records is permitted WITHOUT patient consent?
- Disclosure to the patient's employer to verify fitness for duty
- Disclosure to medical personnel to the extent necessary to meet a bona fide medical emergency (Correct answer)
- Disclosure to a local newspaper investigating the program
- Disclosure to a landlord who requests treatment history
Correct answer: Disclosure to medical personnel to the extent necessary to meet a bona fide medical emergency
Part 2 permits disclosure without consent in limited circumstances, including bona fide medical emergencies, certain research, audits and evaluations, and reporting suspected child abuse under state law. The emergency disclosure must be documented.
Question 5: How did the 2024 final rule change the penalties for Part 2 violations?
- It eliminated all penalties
- It aligned Part 2 enforcement with HIPAA's civil and criminal penalty structure (Correct answer)
- It made violations punishable only by loss of DEA registration
- It made state attorneys general the only enforcers
Correct answer: It aligned Part 2 enforcement with HIPAA's civil and criminal penalty structure
Implementing Section 3221 of the CARES Act, the 2024 rule replaced Part 2's older criminal-fine-only scheme with HIPAA's civil money penalty tiers and criminal penalties. It also applied breach notification requirements to Part 2 records.
Question 6: When Part 2 records are disclosed with patient consent, what must accompany the disclosure?
- A copy of the patient's insurance card
- A notice informing the recipient that the records are protected by 42 CFR Part 2 and that redisclosure is restricted (Correct answer)
- A certified mail receipt
- The program's annual financial report
Correct answer: A notice informing the recipient that the records are protected by 42 CFR Part 2 and that redisclosure is restricted
Each consented disclosure must include a written notice to the recipient that the information is protected by federal law (42 CFR Part 2) and that redisclosure is limited. The 2024 rule allows a shorter statement, but the notice requirement remains.
