HIPAA Mental Health and Substance Abuse Privacy Rules 2 — Questions and Answers
Question 1: Under 42 CFR Part 2, which federal regulation specifically governs confidentiality of substance use disorder patient records?
- HIPAA Privacy Rule
- 42 CFR Part 2 (Correct answer)
- Mental Health Parity Act
- ADA Title II
Correct answer: 42 CFR Part 2
42 CFR Part 2 is the federal regulation specifically protecting the confidentiality of substance use disorder (SUD) patient records at federally assisted programs.
Question 2: A patient's psychotherapy notes are requested by their primary care physician. Under HIPAA, what must the covered entity obtain before releasing them?
- A court order
- The patient's specific written authorization (Correct answer)
- A verbal consent documented in the chart
- Approval from the treating psychiatrist
Correct answer: The patient's specific written authorization
Psychotherapy notes require the patient's specific written authorization for disclosure; they cannot be released under the general treatment/payment/operations exception.
Question 3: Which of the following is NOT considered a psychotherapy note under HIPAA?
- A therapist's personal reflections on session dynamics
- Medication prescriptions for a psychiatric patient (Correct answer)
- Notes kept separate from the medical record
- A therapist's analysis of patient transference
Correct answer: Medication prescriptions for a psychiatric patient
Medication prescriptions, even for psychiatric conditions, are not psychotherapy notes — they are part of the general medical record subject to standard HIPAA rules.
Question 4: Under 42 CFR Part 2 (as amended in 2020), a patient can now sign a single general consent allowing their SUD records to be shared with which category of recipients?
- Any member of the public
- Their treating providers as part of a treatment team (Correct answer)
- Law enforcement upon request
- Insurance companies for any purpose
Correct answer: Their treating providers as part of a treatment team
The 2020 amendment allows a single general consent to cover disclosures to treating providers on a treatment team, streamlining care coordination while maintaining protections.
Question 5: A covered entity may disclose a patient's mental health PHI without authorization for treatment purposes. Which scenario is an EXCEPTION to this rule?
- Referring a patient to a specialist
- Sharing records with a consulting psychiatrist
- Releasing psychotherapy notes to another provider (Correct answer)
- Sending lab results to the treating physician
Correct answer: Releasing psychotherapy notes to another provider
Psychotherapy notes always require specific patient authorization even for treatment purposes, making them an exception to the general treatment disclosure permission.
Question 6: A substance abuse treatment program receives a subpoena for a patient's records. Under 42 CFR Part 2, what is the program's proper response?
- Comply with the subpoena immediately
- Notify the patient and resist disclosure without a court order and patient consent (Correct answer)
- Release records only to the court clerk
- Provide a redacted version within 48 hours
Correct answer: Notify the patient and resist disclosure without a court order and patient consent
Under 42 CFR Part 2, a subpoena alone is insufficient — the program must resist disclosure unless there is both a court order and patient consent, or another specific exception applies.
Question 7: When must a covered entity honor a patient's request to restrict disclosure of mental health PHI to their health plan?
- Always, regardless of circumstances
- Only when the patient pays for the service out-of-pocket in full (Correct answer)
- Only for inpatient psychiatric admissions
- Never — the plan always has the right to the records
Correct answer: Only when the patient pays for the service out-of-pocket in full
Under HIPAA, a covered entity must honor a patient's restriction request when the patient pays for the service out-of-pocket in full and the disclosure is to a health plan for payment or operations purposes.
HIPAA Mental Health and Substance Abuse Privacy Rules 2
Under 42 CFR Part 2, which federal regulation specifically governs confidentiality of substance use disorder patient records?