HIPAA, Consents, and 42 CFR Part 2 - Tracking the Release of Information Under Conflicting Rules

Overview:

For much of healthcare, HIPAA sets the standards for how to manage uses and disclosures of patient information, known as Protected Health Information (PHI).

But when it comes to information related to the treatment of substance use disorders, regulations of the Substance Abuse and Mental Health Services Administration (SAMHSA) under 42 CFR Part 2 prevail, including rigorous controls on the release and re-release of patient information. 

Why should you Attend: While HIPAA rules apply to all Protected Health Information, the rules under 42 CFR Part 2 place special limitations on substance use disorder-related information. HIPAA has controls on the release of health information, but once it's released under HIPAA, the information is allowed to be used according to the regulations and obligations of the receiving party. 

With information under Part 2, the obligations to protect the information travel with the information, placing recipients under obligations to provide further protection under Part 2 rules. 

For decades, the rules under 42 CFR Part 2 have required that each and every release of information have a consent in place, but new rules allow release to "others involved in my care," including re-release of information without a new consent. 

While this new option promises to simplify the release and re-release of information, implementation requires that it be possible to report to the individual a list of parties to whom the information has been released. The accounting for these disclosures is similar to the HIPAA accounting of disclosures in principle, but applies to treatment disclosures all the way down the chain of releases. 

HIPAA allows a number of disclosures, for treatment, payment, and healthcare operations purposes, without consent from the individual being treated. 

SAMHSA rules, on the other hand, require consent for every disclosure or re-disclosure, and if the proper consents aren't obtained, the provider can be in violation of the rules and subject to penalties. 

Areas Covered in the Session:

• What HIPAA allows, what SAMHSA requires, and the differences will be explained
• We will Examine how to Determine if the services you provide place you under 42 CFR Part 2
• We will explore the means for making sure substance abuse Treatment Information Receives the Appropriate Protections
• The Consent and Release Requirements under HIPAA will be explained
• The consent and Release Requirements under 42 CFR Part 2 will be explained
• Re-release of Information released under 42 CFR Part 2 will be discussed
• Sharing of Information with Family and Friends in an overdose Incident will be explored
• Requirements for Providing an accounting of disclosures of Part 2 Information will be Explained
• Challenges in Managing mixed records with Some Part 2 and some non-Part 2 Data will be Discussed

Who Will Benefit:

• Compliance Director
• CEO
• CFO
• Privacy Officer
• Security Officer
• Information Systems Manager
• HIPAA Officer
• Chief Information Officer
• Health Information Manager
• Healthcare Counsel/Lawyer
• Office Manager

Speaker Profile 

Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a wide variety of health care entities. 

Event link:  https://www.mentorhealth.com/webinar/-801716LIVE?channel=eventsget-august_2019_SEO

Contact Info:

Netzealous LLC - MentorHealth

Phone No: 1-800-385-1607

Fax: 302-288-6884

Email: [email protected]

Website: http://www.mentorhealth.com/