CHPC Substance Use Disorder Records (42 CFR Part 2)

Question 1

To which entities does 42 CFR Part 2 generally apply?

Accepted Answer

Federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment or referral for treatment

Answer

Part 2 applies to federally assisted 'programs' that hold themselves out as providing SUD diagnosis, treatment or referral for treatment. Federal assistance is defined broadly and includes Medicare participation, DEA registration and tax-exempt status. Part 2 also restricts lawful holders who receive Part 2 records.

Question 2

Under the 2024 Part 2 final rule, what change was made to patient consent for treatment, payment and health care operations?

Accepted Answer

A patient may give a single consent for all future uses and disclosures for TPO

Answer

The February 2024 final rule allows a single patient consent covering all future TPO uses and disclosures. Recipients that are HIPAA covered entities or business associates may then redisclose the records as HIPAA permits, except for use in proceedings against the patient.

Question 3

Without the patient's specific consent or a qualifying court order, Part 2 records may NOT be used for which purpose?

Accepted Answer

Civil, criminal, administrative or legislative proceedings against the patient

Answer

A key Part 2 protection, kept in the 2024 rule, is that records cannot be used or disclosed to investigate or prosecute the patient, or in proceedings against the patient, without specific consent or a court order that meets Part 2's requirements.

Question 4

Which disclosure of Part 2 records is permitted WITHOUT patient consent?

Accepted Answer

Disclosure to medical personnel to the extent necessary to meet a bona fide medical emergency

Answer

Part 2 permits disclosure without consent in limited circumstances, including bona fide medical emergencies, certain research, audits and evaluations, and reporting suspected child abuse under state law. The emergency disclosure must be documented.

Question 5

How did the 2024 final rule change the penalties for Part 2 violations?

Accepted Answer

It aligned Part 2 enforcement with HIPAA's civil and criminal penalty structure

Answer

Implementing Section 3221 of the CARES Act, the 2024 rule replaced Part 2's older criminal-fine-only scheme with HIPAA's civil money penalty tiers and criminal penalties. It also applied breach notification requirements to Part 2 records.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC Substance Use Disorder Records (42 CFR Part 2)