Overview of 42 CFR Part 2
42 CFR Part 2 is a federal regulation that provides heightened confidentiality protections for records created by federally assisted substance use disorder treatment programs. RHIA candidates must understand that Part 2 protections are generally more restrictive than HIPAA, and where the two regulations conflict, the more stringent standard governs disclosure.
Who Is Covered
Part 2 applies to any program that specializes in providing substance use disorder diagnosis, treatment, or referral and that receives federal assistance, which can include federal funding, tax-exempt status, or certification under Medicare. This is a program-based standard, meaning it applies to specialized programs rather than to every healthcare provider who happens to treat a patient with a substance use disorder.
Consent Requirements
Under Part 2, disclosure of protected records generally requires the patient's written consent, and that consent must specify who may disclose the information, to whom it may be disclosed, the purpose of the disclosure, and an expiration date or event. General authorizations broadly permitting release "for treatment purposes" are not sufficient under Part 2's specific consent standard, unlike some HIPAA disclosures.
Redisclosure Prohibition
A key feature of Part 2 is the prohibition on redisclosure. Any record disclosed under Part 2 must include a notice prohibiting the recipient from further disclosing the information unless permitted by the regulation, which prevents information from flowing beyond its intended, consented purpose.
Exceptions to Consent
- Medical emergencies where disclosure is necessary to treat a condition posing an immediate threat to health
- Court orders that meet specific procedural requirements under Part 2
- Internal communications among personnel within the same program
- Disclosures to a qualified service organization under a written agreement
Recent Alignment with HIPAA
Regulatory updates have moved to better align Part 2 with HIPAA, permitting broader use of a single consent for treatment, payment, and healthcare operations once initial consent is obtained, while still maintaining the redisclosure notice requirement and enhanced penalties for violations.
Exam Tip
Expect scenario questions asking whether a general HIPAA authorization is sufficient to release substance use disorder treatment records; remember that Part 2's specific consent elements typically still apply.