3-Hour Virtual Seminar on HIPAA vs. SAMHSA 42 CFR Part 2: Managing Disclosures when Substance Use Disorders Are Involved

Overview: This session focuses on the issues of managing health information when it may 
involve substance use disorder treatment information. HIPAA allows a number of disclosures 
without consent that SAMHSA prohibits without consent. First we will explain how HIPAA relates to 
information management and release and explain the processes required for various releases of 
information under the HIPAA rules, including release according to individual access requests, and 
under HIPAA authorizations.
When substance use disorder treatment information is involved, first you need to understand how 
to identify it. We will discuss how to make it distinguishable from "regular" health information, 
so that the appropriate extra protections can be provided. You may be able to use functions in 
your EHR to flag the information, or you may create a manual process for tracking the 
information, if it is rarely handled in your organization. And the substance use disorder 
treatment information you collect may or may not be under SAMHSA depending on whether or not you 
have a department or even a response team that specializes in SAMHSA-related situations. You need 
to understand your status under the rules before you release information inappropriately. We will 
discuss what qualifies treatment that falls under SAMHSA. 
If your organization provides services that create information that is under the SAMHSA 
regulations, you will need to establish the consent and release of information processes that are 
required to be followed for information releases under 42 CFR Part 2. This involves getting the 
proper consents upon establishment of the relationship, as well as managing consents for releases 
that may be necessary after the initial establishment of the relationship. The session will 
include an explanation of the consent and release requirements that must be followed. 
When you release information under HIPAA, there are no special notices required to be placed on 
the records. But when you release information under SAMHSA, each document must have a notice that 
explains that re-disclosure is not permitted without a new consent. Complicating matters are 
updated rules going into effect that will allow a consent that permits a re-release to a defined 
team of providers caring for the individual, but then require meticulous documentation of to whom 
the information has been released under such a consent.The session will go over the rules on 
consents and re-release of information. 
With the current epidemic of opioid abuse, there has been a great deal of publicity around the 
release of information and the necessity to share information with family and friends to 
facilitate recovery, but the rules remain in place as is. HIPAA allows such releases under some 
circumstances, while a consent is required under 42 CFR Part 2.HHS has issued guidance on how to 
deal with the regulations in the face of the crisis, but the inconsistencies and difficulties 
remain. In this session we will review the guidance and learn how it helps explain some of the 
rules. 
In addition, the session will review the processes used for and some of the enforcememt 
settlements reached in the reporting of breaches under HIPAA, as well as proposals to further 
harmonize HIPAA and 42 CFR Part 2, including the levying of HIPAA-level penalties for violations 
of the Part 2 rules. The latest proposals to modify the Part 2 rules and their potential impacts 
will be discussed.