Notice of Federal Confidentiality Laws Relating to Substance Use Disorder Information – Behavioral Health

Native Health provides substance use disorder screening, diagnosis or treatment services and is a federally assisted substance use disorder program that is required to comply with 42 USC § 290dd-2 and 45 C.F.R. Part 2, also called the federal “Part 2 Regulations”.  The Part 2 Regulations govern the use and disclosure of substance use disorder information and generally require a patient’s substance use disorder information be held confidentially and securely and not released to a third party without the patient’s signed written consent that meets the requirements of 42 C.F.R. § 2.31.  As described below, there are limited circumstances in which Native Health may disclose a patient’s substance use disorder information without the patient’s written consent.

Notice.  Native Health must notify persons seeking and/or receiving substance use disorder services of the existence of these federal confidentiality laws and regulations and provide each person with this written summary of its confidentiality provisions. The notice and summary must be provided at admission or as soon as deemed clinically appropriate by the person responsible for clinical oversight of the person.

Release Pursuant to Patient Consent.  A patient may consent to the release of information concerning diagnosis, treatment or referral from a substance use disorder program using a form that meets the requirements of the Part 2 Regulations.  Any disclosure, whether written or oral, made with the person’s authorization as provided above must be accompanied by the following abbreviated written statement: “Federal law/42 CFR part 2 prohibits unauthorized disclosure of these records.”

If the person is a minor, consent must be given by both the minor and their parent or legal guardian.

If the person is deceased, consent may be given by:

• A court-appointed executor, administrator or other personal representative;
• If no such appointments have been made, by the person’s spouse; or
• If there is no spouse, by any responsible member of the person’s family.

Release of Information Without A Patient’s Consent.  A patient’s consent is not required under the following circumstances for Native Health to disclose substance use disorder information to a third party:

• Medical Emergencies – information may be disclosed to medical personnel who need the information to treat a condition which poses an immediate threat to the health of any individual, not necessarily the currently or previously enrolled person, and which requires immediate medical intervention. Medical emergency includes when a Part 2 program is closed and unable to provide services or obtain the prior written consent of the patient, during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time that the part 2 program resumes operations.  Immediately following disclosure, the Part 2 Program must document in the person’s medical record the name of the medical person to whom disclosure is made and their affiliation with any health care facility, name of the person making the disclosure, date and time of the disclosure and the nature of the emergency. 
• FDA Reporting -- Patient identifying information may be disclosed to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that the health of any individual may be threatened by an error in the manufacture, labeling, or sale of a product under FDA jurisdiction, and that the information will be used for the exclusive purpose of notifying patients or their physicians of potential dangers.  Immediately following disclosure, the Part 2 Program must document in the person’s medical record the name of the medical person to whom disclosure is made and their affiliation with any health care facility, name of the person making the disclosure, date and time of the disclosure and error.
• Payment and Health Care Operations: If a patient consents to disclose their information for payment or health care operations purposes (in accordance with 42 C.F.R.§§ 2.31 and 2.33), the lawful holder of that information may re-disclose the minimum amount of information necessary to contractors, subcontractors, and legal representatives for purposes of payment and health care operations. Disclosures to contractors, subcontractors, and legal representatives are not permitted to carry out other purposes, such as activities related to patient diagnosis, treatment, or referral for treatment. Payment and health care operations activities include the following:
• Billing, claims management, collections activities, obtaining payment under a contract for reinsurance, claims filing and related health care data processing;
• Clinical professional support services (e.g., quality assessment and improvement initiatives; utilization review and management services);
• Patient safety activities;
• Activities pertaining to:
• The training of student trainees and health care professionals,
• The assessment of practitioner competencies,
• The assessment of provider and/or health plan performance, and
• Training of non-health care professionals;
• Accreditation, certification, licensing, or credentialing activities;
• Underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care;
• Third-party liability coverage;
• Activities related to addressing fraud, waste and abuse;
• Conducting or arranging for medical review, legal services, and auditing functions;
• Business planning and development, such as conducting cost-management and planning related analyses related to managing and operating, including formulary development and administration, development or improvement of methods of payment or coverage policies;
• Business management and general administrative activities, including management activities relating to implementation of and compliance with the requirements of this or other statutes or regulations;
• Customer services, including the provision of data analyses for policy holders, plan sponsors, or other customers;
• Resolution of internal grievances;
• The sale, transfer, merger, consolidation, or dissolution of an organization;
• Determinations of eligibility or coverage (e.g., coordination of benefit services or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims;
• Risk adjusting amounts due based on enrollee health status and member characteristics; 
• Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; and
• Care coordination and/or case management services in support of payment or health care operations; and/or
• Other payment/health care operations activities not expressly prohibited by the Part 2 Regulations.
• Research Activities – information may be disclosed for the purpose of conducting scientific research according to the provisions of 42 CFR § 2.52.
• Audit and Evaluation Activities – information may be disclosed in accordance with 42 CFR § 2.53 to any individual or entity who performs an audit or evaluation on behalf of:
• federal, state, and local government agencies providing financial assistance to, or regulating the activities of, lawful holders; 
• individuals or entities which provide financial assistance to the Part 2 Program or other lawful holder, which is a third-party payer covering patients in the Part 2 Program, or which is a quality improvement organization performing a QIO review, or the contractors, subcontractors, or legal representatives of such individual, entity, or QIO; or
• an entity with direct administrative control over the Part 2 Program or lawful holder.

Disclosure of substance use disorder information without patient consent is also permitted to individuals or entities for the purpose of conducting a Medicare, Medicaid, or CHIP audit or evaluation, including an audit or evaluation necessary to meet the requirements for a Centers for Medicare & Medicaid Services (CMS)-regulated accountable care organization (CMS-regulated ACO) or similar CMS-regulated organization (including a CMS-regulated Qualified Entity (QE)).

• Qualified Service Organizations – information may be provided to a qualified service organization when needed by the qualified service organization to provide services to the Part 2 Program.
• Internal Agency Communications - the staff of an agency providing alcohol and drug abuse services may disclose information regarding an enrolled person to other staff within the agency, or to the part of the organization having direct administrative control over the agency, when needed to perform duties related to the provision of substance use disorder diagnosis, treatment, or referral for treatment to a person.  For example, an organization that provides several types of services might have an administrative office that has direct administrative control over each unit or agency that provides direct services.
• Court-ordered disclosures. A State or federal court may issue an order that authorizes an agency to make a disclosure of identifying information that would otherwise be prohibited. A subpoena, search warrant or arrest warrant is not sufficient standing alone, to require or permit an agency to make a disclosure.
• Crimes committed by a person on an agency’s premises or against program personnel. Agencies may disclose information to a law enforcement agency when a person who is receiving treatment in a substance abuse program has committed or threatened to commit a crime on agency premises or against agency personnel. In such instances, the agency must limit the information disclosed to the circumstances of the incident. It may only disclose the person’s name, address, last known whereabouts and status as a person committing or threatening to commit the crime.
• Child abuse and neglect reporting. Federal law does not prohibit compliance with the child abuse reporting requirements contained in A.R.S. § 13-3620.  However, the restrictions continue to apply to the original substance use disorder patient records maintained by the Part 2 Program including their disclosure and use for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect.

Criminal Justice Referrals.   A Part 2 Program may disclose information about a patient to those individuals within the criminal justice system who have made participation in the Part 2 Program a condition of the disposition of any criminal proceedings against the patient or of the patient's parole or other release from custody if the provisions in 42 C.F.R. § 2.35 are satisfied.

Acknowledging Presence or Receipt of Services.  Native Health may not acknowledge that a currently or previously enrolled person is receiving or has received substance use disorder services without the enrolled person’s authorization or a court order that complies with the Part2 Regulations.  However, the regulations do permit acknowledgement of the presence of an identified patient in a health care facility or part of a health care facility if the health care facility is not publicly identified as only a substance use disorder diagnosis, treatment, or referral for treatment facility, and if the acknowledgement does not reveal that the patient has a substance use disorder.

Native Health must respond to any request for a disclosure of medical records of a currently or previously enrolled person in a way that will not reveal that an identified individual has been, or is being diagnosed or treated for substance use disorder, unless the request is accompanied by the patient’s consent under 42 CFR § 2.31 or the disclosure is otherwise permitted under the Part 2 Regulations.

Part 2 Questions and Suspected Violations.  A violation of the federal law and regulations by a Part 2 Program is a crime.  Suspected violations may be reported to the United States Attorney’s Office for the District of Arizona, Two Renaissance Square 40 N. Central Avenue, Suite 1800, Phoenix, AZ 85004-4449, (602) 514-7500.  You may also contact John Molina, Corporate Compliance Officer at NATIVE HEALTH, at 602-279-5262 ext. 3138, if you have any questions or concerns regarding the confidentiality of your substance use disorder information.