New HIPAA Requirements for Substance Use Disorder Privacy Protections
On recent visits to see my physicians, I’m asked to use an electronic pen to sign a pad “about HIPAA.” I have no idea what I’m signing. I’m not shown the document, though I assume if I asked, the receptionist would grudgingly find a copy.
One of the documents that patients should have access to is Notice of Privacy Practices. It identifies how the practice secures your protected health information. It likely discusses the exceptions for requiring your signed authorization to disclose protected health information, such as Treatment, Payment, and Operations. Or to comply with requirements of the County Health Department. Or to investigate a crime on the practice’s premises. And so on.
It might detail that the patient can restrict how their data are used, but the practice may not be obligated to agree. But if the practice does agree, it is obligated to honor its commitment.
It may also discuss what to do if you disagree with what’s written in the medical record.
It can be a long document.
It’s about to get longer.
Entities regulated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including employer-sponsored health plans, have until February 16, 2026, to comply with additional privacy protections for patient records related to substance use disorder. A separate permission is required for disclosing information about a person’s substance use disorder.
HIPAA will soon mandate that Notice of Privacy Protections include language about protections for Substance Use Disorder Records. We’ve included sample language below:
Special Privacy Protections for Substance Use Disorder Records
Certain records related to substance use disorder diagnosis, treatment, or referral for treatment are protected by 42 CFR Part 2, a federal law that provides additional privacy protections beyond HIPAA.
Federal law prohibits unauthorized disclosure of substance use disorder records.
Disclosure of these records is permitted only with your written consent or as otherwise permitted by 42 CFR Part 2.
Recipients of this information may not re-disclose it unless permitted by federal law.
Substance use disorder records protected by 42 CFR Part 2 will not be disclosed for treatment, payment, or health care operations without your written consent, except as permitted by federal law.
Disclosures of substance use disorder records generally require your specific written consent.
You may revoke your consent at any time, except to the extent that action has already been taken in reliance on it.
You have the right to the confidentiality of your substance use disorder records under federal law.
You may file a complaint if you believe your Part 2 rights have been violated, and you will not be retaliated against for doing so.
Federal law permits limited disclosures of substance use disorder records without your consent in specific circumstances, including medical emergencies, research, audits or evaluations, and court orders that meet federal requirements.
You may file a complaint with this organization or with the U.S. Department of Health and Human Services if you believe your rights under HIPAA or 42 CFR Part 2 have been violated.
When substance use disorder records are involved, 42 CFR Part 2 controls even if HIPAA would otherwise permit disclosure.
In other words, please be aware of the special sensitivity of records for substance use disorders. If a patient has disclosed they were in an alcohol recovery program, for example, and that is part of the past medical history, one cannot disclose that to a party requesting records unless the patient gives explicit authorization to do so. Many HIPAA authorization forms do have a checkmark for substance use disorders. So, make sure it is checked and the document is signed before sending confirmation of the patient’s history of alcohol abuse.
Many practices have already treated sensitive details such as history of sexually transmitted diseases, substance use disorders, or psychiatric diagnoses as requiring explicit consent. Regarding substance use disorders, that requirement for sensitivity has been codified by a new regulation.
What do you think?
