Substance Abuse and HIPAA: HHS Adopts Changes to 42 CFR Part 2 Regulations

Substance Abuse MeetingDrug addicts have a lot of problems to deal with. It's a disease that can make life very difficult. Especially if employers and housing authorities find out that they have a problem. Even for those who are trying to recover from an addiction, there's a lot of stigmas. This can make it even more difficult for them to recover if it denies them work or housing. That's why the Health Insurance Portability and Accountability Act (HIPAA) decided to protect those that are trying to get treatment for their addictions. The protections are laid out in 42 CFR Part 2. Read on to learn about all of the newest changes to this legislation.

What Does 42 CFR Part 2 Do?

Like the rest of HIPAA, 42 CFR Part 2 aims to protect the privacy of patients. When this legislation started, the concern was that medical issues could be used against vulnerable groups. In this case, there were concerns that if employers forced people seeking substance abuse treatment to disclose that information, they might become more vulnerable than their counterparts who did not seek treatment. Most medical professionals will agree that the priority should be getting help to these people. This is hard to do when there is more motivation for people to continue their addiction in secret rather than getting treatment. When 42 CFR Part 2 came out, this was the theory as well. It protected drug addicts who were trying to get clean from any repercussions by employers or family members. It meant that anyone who was seeking addiction treatment wouldn't need to disclose that information to anyone but their doctors. Doctors, in turn, aren't allowed to disclose that information to anyone. The only exception to that rule is emergency contacts. There must be permission documented by the patient if this is the case. However, this legislation was not perfect when it began in 1975. Many medical professionals have said that it makes care coordination too difficult and can put patients at risk. So in 2019, the government enacted some changes to 42 CFR Part 2.

The Changes

The structure of 42 CFR Part 2 will generally remain the same. The idea is still to protect the confidentiality of patients. However, some changes needed to take effect to more effectively protect both the patient and their privacy.

Record Keeping

From here on out, all records made by non-Part 2 providers will not be covered by Part 2. If you want your treatment records to for protection under Part 2, from now on you will have to use a Part 2 program. Such records can transfer from a non-Part 2 program to one covered under Part 2. This protects substance abuse treatment records from any HIPAA breach that might occur. These records should be secure and sealed to anyone that doesn't have written permission to access those files. This protects the patient from becoming vulnerable on account of them seeking addiction treatment. Employers don't have to know about the treatment, so they cannot discriminate against addicts. You also can't be denied housing on account of seeking treatment. As long as these records are sealed and protected, these will never be an issue for someone who is trying to recover.

Removal of Messages

It's common practice for employees to give patients their personal phone numbers or emails in case of an emergency. This can lead to problems if the patient accidentally sends personal information over text or email to the employee's device. That is the sort of information that a medical professional shouldn't have access to on a personal device. The changes allow for these employees to delete these messages. They must do this to stay under HIPAA compliance. If the message were to stay on that personal device, then chances are anyone in the employee's household could see it. This is a massive breach of HIPAA regulations since that information should remain confidential. So this change provides guidelines for what they call "sanitizing" their device to remain under HIPAA compliance. This protects the confidentiality of their patients simply by having the messages deleted off of personal devices.

Staying Anonymous

A change to 42 CFR Part 2 makes it possible for patients to disclose treatment information to certain entities while still staying anonymous. In other words, you could provide permission for the Social Security Administration to access details about your treatment without ever disclosing who was actually treated. This means that there's no risk of employers or government agencies linking the treatment back to you. This protects your information from housing developments that might check for this kind of background. That means you can never be denied housing just for receiving treatment. Employers also cannot have access to this sort of information. They are not allowed to discriminate against recovering addicts. Even if employers or housing authorities get ahold of your treatment plans, they cannot legally ask your physician for more details. This would be a violation of HIPAA and could land any physician that provides such information in prison.


Occasionally, information on treatments is necessary for billing or other medical treatments. This can be risky as it can lead to information leaks. To account for this, 42 CFR Part 2 has made a change to allow patients to permit this. They must give signed written documentation stating permission for the disclosure of treatment information. This is all protected under what HIPAA considers "payment and health care operations." They've also added a list of eighteen events that are these payment and healthcare operations. Before, there was no breakdown of what this means. Now there are proper procedures in place that make this process easier. Now that these events are properly defined, it's also easier to tell when certain entities must be given your treatment information. This keeps your information safer since you can be sure it's being given to people who actually need it.

Non-Opioid Substance Abuse

Many people have problems with non-opioid drugs. Others might have issues with multiple drugs which include opioids. These people might need to participate in multiple treatment programs. It can be helpful for non-opioid treatment programs to have an idea of what other treatments the patient has found success with in the past. To that end, the new laws allow these programs to request documentation of treatments for new patients seeking treatment for non-opioid addictions. You will naturally need to give written permission to make this happen. No documentation will move between programs without your expressed permission. This will help keep your records confidential from any entities that you don't want seeing them. You now get the chance to look over all documentation being sent. You also can get a good look at whom the documents are being sent to. Otherwise, it would be difficult to be sure who has access to your information. It's completely possible that potential employers or housing authorities to get ahold of this information as well. This is exactly what HIPAA is trying to avoid with these changes. That's why these changes were made in the first place.

Prescription Monitoring

Opioid treatment programs often need to make sure that their patients are taking any prescriptions on time. They also need to make sure that patients aren't getting ahold of opioids to abuse through the pharmacy. This is to ensure that patients don't relapse when they've already been doing well. To that end, states can open prescription drug monitoring programs that treatment programs can participate in. This means that whenever the program prescribes new drugs to patients. This can help prevent dangerous interactions due to taking multiple prescriptions. This will apply to medications from schedules two to five. These are the medications that need to be more carefully controlled. They generally have a high risk of addiction or abuse. The higher the schedule of a drug, the more the risk there is of abuse or addiction. This is why they store these drugs where there's stricter security. These state programs allow pharmacies and programs to know exactly what patients are currently taking. It helps to prevent relapses as well as adverse interactions. This protects the patient from any injuries due to a lack of communication between doctors. And the important thing is that only pharmacists and program employees will ever know exactly what you take.

Learn More About HIPAA Today

All of this protects drug addicts from the stigmas that they might face in today's society. The idea is to encourage addicts to get the help that they need. HIPAA helps by keeping their records confidential from anyone who might discriminate based on a history of addiction. Otherwise, there'd be no motivation for them to get help. They'd be better off keeping their problem secret. So HIPAA getting addicts the help they need is a good thing. And these changes will help keep records confidential. If you enjoyed this article, be sure to check out our other articles about changes to HIPAA regulations.