HIPAA Blog

[ Saturday, January 24, 2026 ]

 

"Part 2" Providers: Don't Forget to Update Your NoPPs by February 16.  Are you a "Part 2" provider?  If you don't know, you probably aren't.  "Part 2" refers to 42 CFR Part 2, which is the provision of the Code of Federal Regulations adding specifics to the general confidentiality provisions of 42 USC 290dd-2, requiring hightened confidentiality for the medical records of people seeing substance abuse treatment.  Initially enacted as a part of 1970's Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act, the law was meant to address the concern that people with drug abuse problems would not seek help out of fear that their treatment information would be used against them by law enforcement. The statute's provisions are very general; hence the regulations seek to flesh them out. The Part 2 rules existed before HIPAA, and are a sort of "super-HIPAA" level of protection for those particularly-sensitive medical records.

The regulations did not change over the years, while changes in the way medical records are kept, transferred, and used have changed dramatically, so HHS recently has made changes.  The regulations only apply to federally funded or supported substance use disorder providers.  Most of them know who they are.

And if you are one, be aware that you need to add some specific references to those Part 2 rules into your NoPP.  If it doesn't already say so, your NoPP should specifically say that you are subject Part 2.  Additionally, in the NoPP descriptions of (i) permitted disclosures for treatment, payment, and healthcare operations, and (ii) disclosures for which authorization is not required, you should add language indicating that the PHI you disclose imay not be used in legal proceedings against the patient except with consent or a court order.  Finally, Part 2 organizations that intend to use PHI for fundraising must give patients the clear opportunity to opt out of such fundraising.  

Finally, if the Part 2 provider is involved in a Organized Health Care Arrangement, the OHCA's NoPP must contain the provisions required to be included in the Part 2 provider's NoPP.


Jeff [3:53 PM]

Comments: Post a Comment
http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template