Certain types of medical records require more sensitive handling due to their greater privacy and confidentiality restrictions, including substance use disorder (SUD) records regulated ScanSTAT works with our clients who are subject to 42 CFR Part 2 and its governance under the Substance Abuse and Mental Health Services Administration (SAMHSA).
We collaborate with clients to determine a course of action if substance abuse treatment records reside in the client’s electronic health record (EHR) system. ScanSTAT processes and releases these Part 2 substance abuse treatment records with heightened sensitivity in accordance with HIPAA, 42 CFR Part 2 and other privacy standards using our Release of Information Part 2 specialized service line.
As a trusted Business Associate for medical records release and health information management, ScanSTAT wants to ensure you are aware of the latest guidance and empowered to make the best decision on the handling of these sensitive records.
WHAT IS 42 CFR PART 2?
Substance abuse treatment records (also referred to as substance use disorder (SUD) records) are regulated within the Federal Register under section 42 CFR Part 2. These records are often called “Part 2” records because of where the Substance Abuse Confidentiality Regulations are found within the Code of Federal Regulations.
These regulations hold substance abuse treatment records to the highest degree of privacy granted to medical records under federal law. Typical HIPAA concepts like being able to exchange records without a patient authorization for Treatment / Payment / or Operations (“TPO”) purposes do not apply to these SUD records. In fact, substance abuse treatment records have a prohibition on redisclosure meaning that the records specifically cannot be disclosed without written patient consent.
HOW DOES A COVERED ENTITY QUALIFY AS PART 2?
If your organization includes healthcare providers that 1) receive certain federal funding[i] and 2) hold themselves out to the public as providing substance use disorder diagnosis, treatment or referral for treatment[ii], you likely have medical records within your EHR that are governed by 42 CFR Part 2. As such, certain providers within your organization (known as your Part 2 Program) are required to abide by additional confidentiality protections above and beyond the requirements of the HIPAA Privacy Rule.[iii]
WHY ARE SUD RECORDS MORE CONFIDENTIAL?
42 CFR Part 2, and its governing body SAMHSA, have been around since the 70s, much older than when HIPAA was enacted in 1996. Part 2 was introduced to encourage people suffering from drug and alcohol addiction issues to seek treatment without fear of retribution; therefore, these records are to be held in the highest confidence allowing the patient to act as the gatekeeper in the movement of these records. As a discouragement for violating the confidentiality of these SUD records, the regulations provide a stricter remedy than is afforded under HIPAA: Part 2 comes with possible criminal penalties for wrongful disclosures.
Part 2 Programs are prohibited from disclosing any information that would identify a person as having had a substance use disorder unless that person provides written consent. Part 2 specifies a set of requirements for consent forms. (A full description of the requirements of a Part 2 consent form is available online here.)
Explore our Part 2 Resource Library Today>>
How does ScanSTAT Handle these Part 2 Records?
If your organization is subject to 42 CFR Part 2, your first step as a Covered Entity is determining whether you prefer your staff handle the Part 2 requests or you trust your Business Associate to fulfill Part 2 requests on your behalf. At ScanSTAT, we’ve done extensive research, workflow development and vetting of the Part 2 process over the years and offer our clients the peace of mind to task those records request to ScanSTAT. The following is an overview of how we establish and service Part 2 requests.
- DISCOVERY: We hold a Part 2 Exploratory Call with you to discuss the naming convention of Part 2 records and/or how they are segregated within your EHR from other medical records that are not governed by the stringent Part 2 regulation. We document where your Part 2 records reside in your EHR, how they are named, and how they are partitioned from non-Part 2 regulated records all to ensure Part 2 records requests are handled properly. As our healthcare data experts fulfill these Part 2 release of information requests, they will follow the agreed upon workflow and ensure the records are fulfilled properly in accordance with the most current laws and guidelines.
- CERTIFIED PROFESSIONALS: Our Part 2 services are built on the advanced and ongoing training of our Part 2 team. Our employees must first go through intensive in-house training and achieve Part 2 certification before joining our Part 2 team. We’ve got the best of the best working these sensitive requests.
- PART 2 PATIENT CONSENT: We ensure there is proper patient consent that meets Part 2 requirements prior to releasing SUD records. The elements of a Part 2 consent form are slightly different than that of HIPAA. We make sure there’s nothing missed!
- SUD/NON-SUD REQUESTS: We determine whether the request is for SUD records governed by Part 2 or for other information in the patient’s medical chart.
- 100% QA FOR SUD REQUESTS: We apply additional audit of the SUD records released by ScanSTAT to capture any potential misfiles and ensure full compliance. With the more serious criminal penalties at stake for Part 2 violations, we want to make sure those pesky misfiles don’t leave the door without an authorization. For those clients whose EHR is set-up in a way that makes identifying whether a patient has a SUD chart more challenging, we provide additional auditing support to ensure no SUD records that have been misfiled go out without patient consent.
- HANDLING NON-COMPLIANCE: We ensure we are not disclosing your patients as having received SUD treatment when communicating with requestors. There’s a misunderstanding about Part 2 within the healthcare industry. This lack of awareness means requestors are uninformed and ill equipped to request these types of records. To make this more challenging, Part 2 sets rules around what can be disclosed to requestors and what cannot. We’ve developed a workflow that takes the burden off your practice and onto our dedicated team of Part 2 professionals.
Covered Entities should note that changes to the partitioning of Part 2 records, EHR upgrades, new providers offering substance abuse treatment within the practice and other changes at the practice level may require revisiting your records workflows. Along with well-defined Part 2 processes in place, ScanSTAT depends heavily on the function and set up of the EHR to prevent the comingling of SUD records with other medical records. Our processes require us to have the most current information about your SUD program and EHR set-up.
YOUR PARTNER IN PART 2
As your partner, we’re excited to handle both the routine medical records requests and the more complicated, like those involving substance abuse treatment records. Our healthcare data experts are dedicated, educated and here to help you best serve your patients. If you would like to discuss 42 CFR Part 2 more at length, we’re here for you! Reach out to us to start a conversation or request more information from our expert Compliance and Security Team today.