42 CFR Part 2 applies to records held by any individual or entity that is federally assisted and holds itself out as providing, and provides, alcohol or drug use diagnosis, treatment or referral for treatment. With limited exceptions, Part 2 requires patient consent to disclose protected health information even for the purposes of treatment, payment, or health care operations. Part 2 provides more stringent federal protections than other health privacy laws such as HIPAA and seeks to protect individuals with substance use disorders who could be subject to discrimination and legal consequences in the event that their information is improperly used or disclosed. 42 C.F.R. Part 2. Each disclosure of information made with the patient’s written consent must include notice to the recipient that any further disclosure of information is prohibited unless expressly permitted by the written consent of the patient or as otherwise permitted by 42 CFR Part 2.
A valid authorization to release protected health information under Part 2 must include:
- Name of patient.
- The specific name(s) or general designation of the Part 2 program(s), entity(ies), or individual(s) permitted to make the disclosure, i.e., the holder of the information.
- How much and what kind of information is to be disclosed, including an explicit description of the substance use disorder information that may be disclosed (e.g., medications and dosages, lab tests, substance use history summaries). A patient consenting to disclose “all of my substance use disorder information” is acceptable as long as more granular options are included (so that the patient can choose to authorize disclosure of something less).
- The name(s) of the individual(s) or entity(ies) to whom a disclosure is to be made.
- The purpose of the disclosure which must be limited to the information which is necessary to carry out the stated purpose.
- Signature of the patient, or other authorized representative. (Note that a parent or guardian cannot authorize disclosure of a minor’s information.) If it is not signed by the patient, there must be a description of how the person signing is authorized to represent the patient.
- The date on which the consent is signed.
- The date, event, or condition upon which the consent will expire if not revoked before. This date, condition, or event must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is provided.
- A statement that the consent is subject to revocation at any time except to the extent that the Part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it.
- The consent form must contain a statement that the patient understands the terms of the consent and the patient's right to obtain information about to whom their information was disclosed.
Invalid Authorizations: If any one of the elements of the authorization is omitted, the release is invalid.
Check with your attorney on updates to this information which may happen at any time.