- § 2.1 - Statutory authority for confidentiality of substance use disorder patient records.
- § 2.2 - Purpose and effect.
- § 2.3 - Civil and criminal penalties for violations.
- § 2.4 - Complaints of noncompliance.
§ 2.1 - Statutory authority for confidentiality of substance use disorder patient records.
Title 42, United States Code, section 290dd-2(g) authorizes the Secretary to prescribe regulations to carry out the purposes of section 290dd-2. Such regulations may contain such definitions, and may provide for such safeguards and procedures, including procedures and criteria for the issuance and scope of orders under subsection 290dd-2(b)(2)(C), as in the judgment of the Secretary are necessary or proper to effectuate the purposes of section 290dd-2, to prevent circumvention or evasion thereof, or to facilitate compliance therewith.
§ 2.2 - Purpose and effect.
(a) Purpose. Pursuant to 42 U.S.C. 290dd-2(g), the regulations in this part impose restrictions upon the use and disclosure of substance use disorder patient records (“records,” as defined in this part) which are maintained in connection with the performance of any part 2 program. The regulations in this part include the following subparts:
(1) Subpart B: General Provisions, including definitions, applicability, and general restrictions;
(2) Subpart C: Uses and Disclosures With Patient Consent, including uses and disclosures that require patient consent and the consent form requirements;
(3) Subpart D: Uses and Disclosures Without Patient Consent, including uses and disclosures which do not require patient consent or an authorizing court order; and
(4) Subpart E: Court Orders Authorizing Use and Disclosure, including uses and disclosures of records which may be made with an authorizing court order and the procedures and criteria for the entry and scope of those orders.
(b) Effect. (1) The regulations in this part prohibit the use and disclosure of records unless certain circumstances exist. If any circumstance exists under which use or disclosure is permitted, that circumstance acts to remove the prohibition on use and disclosure but it does not compel the use or disclosure. Thus, the regulations in this part do not require use or disclosure under any circumstance other than when disclosure is required by the Secretary to investigate or determine a person's compliance with this part pursuant to § 2.3(c).
(2) The regulations in this part are not intended to direct the manner in which substantive functions such as research, treatment, and evaluation are carried out. They are intended to ensure that a patient receiving treatment for a substance use disorder in a part 2 program is not made more vulnerable by reason of the availability of their record than an individual with a substance use disorder who does not seek treatment.
(3) The regulations in this part shall not be construed to limit:
(i) A patient's right, as described in 45 CFR 164.522, to request a restriction on the use or disclosure of a record for purposes of treatment, payment, or health care operations.
(ii) A covered entity's choice, as described in 45 CFR 164.506, to obtain the consent of the patient to use or disclose a record to carry out treatment, payment, or health care operations.
§ 2.3 - Civil and criminal penalties for violations.
(a) Penalties. Any person who violates any provision of 42 U.S.C. 290dd-2(a)-(d), shall be subject to the applicable penalties under sections 1176 and 1177 of the Social Security Act, 42 U.S.C. 1320d-5 and 1320d-6.
(b) Limitation on criminal or civil liability. A person who is acting on behalf of an investigative agency having jurisdiction over the activities of a part 2 program or other person holding records under this part (or employees or agents of that part 2 program or person holding the records) shall not incur civil or criminal liability under 42 U.S.C. 290dd-2(f) for use or disclosure of such records inconsistent with this part that occurs while acting within the scope of their employment in the course of investigating or prosecuting a part 2 program or person holding the record, if the person or investigative agency demonstrates that the following conditions are met:
(1) Before presenting a request, subpoena, or other demand for records, or placing an undercover agent or informant in a health care practice or provider, as applicable, such person acted with reasonable diligence to determine whether the regulations in this part apply to the records, part 2 program, or other person holding records under this part. Reasonable diligence means taking all of the following actions where it is reasonable to believe that the practice or provider provides substance use disorder diagnostic, treatment, or referral for treatment services:
(i) Searching for the practice or provider among the substance use disorder treatment facilities in the online treatment locator maintained by the Substance Abuse and Mental Health Services Administration.
(ii) Searching in a similar state database of treatment facilities where available.
(iii) Checking a provider's publicly available website, where available, or its physical location to determine whether in fact such services are provided.
(iv) Viewing the provider's Patient Notice or the Health Insurance Portability and Accountability Act (HIPAA) Notice of Privacy Practices (NPP) if it is available online or at the physical location.
(v) Taking all these actions within a reasonable period of time (no more than 60 days) before requesting records from, or placing an undercover agent or informant in, a health care practice or provider.
(2) The person followed all of the applicable provisions in this part for any use or disclosure of the received records under this part that occurred, or will occur, after the person or investigative agency knew, or by exercising reasonable diligence would have known, that it received records under this part.
(c) Enforcement. The provisions of 45 CFR part 160, subparts C, D, and E, shall apply to noncompliance with this part in the same manner as they apply to covered entities and business associates for noncompliance with 45 CFR parts 160 and 164.
§ 2.4 - Complaints of noncompliance.
(a) Receipt of complaints. A part 2 program must provide a process to receive complaints concerning the program's compliance with the requirements of this part.
(b) Right to file a complaint. A person may file a complaint to the Secretary for a violation of this part by a part 2 program, covered entity, business associate, qualified service organization, or lawful holder in the same manner as a person may file a complaint under 45 CFR 160.306 for a violation of the administrative simplification provisions of the Health Insurance Portability and Accountability Act (HIPAA) of 1996.
(c) Refraining from intimidating or retaliatory acts. A part 2 program may not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any patient for the exercise by the patient of any right established, or for participation in any process provided for, by this part, including the filing of a complaint under this section or § 2.3(c).
(d) Waiver of rights. A part 2 program may not require patients to waive their right to file a complaint under this section or § 2.3 as a condition of the provision of treatment, payment, enrollment, or eligibility for any program subject to this part.