Health Care Reform Resource Center
33 Davis Brown Attorneys Selected for The Best Lawyers in America 2014
Davis Brown Attorneys Named Among Best in the U.S.
Immigration Client Resource Center
Voted Des Moines' Best Law Firm

Davis Brown Health Law Blog  



A New Form of Authorization: Complying with Confidentiality for Substance Use Disorder Patients - October 26, 2017

Medical facilities may find their internal policies are in need of an update after recent changes to federal regulations relating to the confidentiality of medical records of substance use disorder patients.


The regulations (42 CFR Part 2, frequently referred to simply as Part 2) were last updated in 1987, prompting concerns that the confidentiality standards had fallen behind while the country’s health care system experienced substantial changes during that 29-year period.


Changes to the regulations, finalized by the Substance Abuse and Mental Health Service, an agency within the Department of Health and Human Services, continue to further the law’s original purpose: to encourage individuals with substance use disorders to seek treatment without fear of their information being released to outside parties.


Substance use disorder programs that are federally regulated or assisted by any federal department or agency must ensure records concerning the identity, diagnosis, prognosis, or treatment of a patient remain confidential.


Fortunately, most medical facilities covered by this regulation will find that the enacted changes will have an insignificant effect on their current policies and practices, and that a few simple updates will bring them into compliance. The most notable change for health care facilities to be aware of concerns changes to authorization form requirements.


General Designations

Before any information relating to or identifying a substance use disorder patient may be released, written authorization must be given. This requirement is not new, but several new requirements change what must be included in an authorization. The following items must appear on a patient authorization form for disclosure to be valid:

  • The name of the patient
  • The name of the program, person, or entity allowed to release the information
  • A description of what and how much information may be disclosed, as well as the purpose of the disclosure
  • The patient’s signature with the date on which consent was given
  • A date, event, or condition for when the authorization will expire
  • A statement acknowledging consent can be revoked at any time, except when an action has already been taken in reliance on the consent already given
  • The name of the individual or organization receiving the information

It is this final point where health care facilities must be careful to ensure they are in compliance with the new regulations. If the entity receiving the information does not have a treating provider relationship with the patient and is also not a third-party payer, then the name of the entity must be provided on the authorization form as well as one of the following:

  • The name of the individual participants
  • The name of an entity that does have a treating provider relationship with the patient, or
  • A general designation of an individual, entity, or class participant limited only to participants who have a treating provider relationship with the patient

Under this final bullet point, if a general designation is used, then a statement must be included on the form informing the patient that s/he can request a list of entities receiving the information.


The patient’s request will have to be in writing and is limited only to disclosures made in the past two years. The entity releasing information must respond to the patient’s request within 30 or fewer days and provide the names of the entities to which disclosures where made, the date of the disclosure, and a brief description of the information disclosed.


While several other updates were made to the regulations, including changes to various definitions and requirements for releasing information for research purposes, the new general designation requirement is the most likely to effect current facility policies and forms.


Releasing Patient Information

A properly executed release from a substance use disorder patient or his/her decisionmaker will allow for the release of information. If there is no properly executed release, then it is important to remember that a subpoena is not enough to require the release of patient information. A properly executed court order, following a court hearing conducted in accordance with federal regulations, is required for the release of information.


Health care facilities should always use caution, review internal policies, and confirm that they are complying with state and federal laws before releasing substance use disorder patient information.