Confidentiality, HIPAA & 42 CFR Part 2
Key Takeaways
- Confidentiality is the cornerstone of peer support, protected by both the HIPAA Privacy Rule and federal 42 CFR Part 2 regulations.
- 42 CFR Part 2 enforces strict confidentiality rules specifically for substance use disorder (SUD) records, requiring explicit consent for disclosure and prohibiting redisclosure without authorization.
- A valid Release of Information (ROI) must include specific statutory components, including named parties, purpose, scope, expiration, and right of revocation.
- Peer recovery support specialists must apply the Minimum Necessary standard under HIPAA to ensure only essential protected health information is disclosed.
Confidentiality, HIPAA & 42 CFR Part 2
Quick Answer: Peer support confidentiality is governed by federal law, state statutes, and ethical codes. The Health Insurance Portability and Accountability Act (HIPAA) protects general Protected Health Information (PHI) across healthcare settings. However, 42 CFR Part 2 is a specialized federal regulation that provides heightened protection specifically for Substance Use Disorder (SUD) treatment records. Under 42 CFR Part 2, SUD records cannot be disclosed or redisclosed without specific, written peer consent—even in circumstances where general HIPAA rules might allow disclosure for treatment, payment, or operations.
The Critical Role of Confidentiality in Recovery
Confidentiality is essential for establishing safety, trust, and rapport between a CRSS specialist and a peer. Individuals seeking recovery from mental health conditions or substance use disorders frequently face societal stigma, potential discrimination in employment or housing, and legal vulnerabilities. Without absolute confidence that their personal disclosures will remain private, individuals are far less likely to engage in recovery support services.
Peer specialists must master the technical legal requirements governing privacy, including HIPAA, 42 CFR Part 2, and the Illinois Mental Health and Developmental Disabilities Confidentiality Act.
HIPAA Privacy Rule in Peer Recovery Settings
The HIPAA Privacy Rule applies to "covered entities" (such as hospitals, community mental health centers, and federally qualified health centers) and their business associates. When a CRSS specialist is employed by a covered entity, all peer interactions, documentation, and communications fall under HIPAA.
Key HIPAA Concepts for Peer Specialists:
- Protected Health Information (PHI): Any individually identifiable health information created, received, or maintained by a covered entity in physical, electronic, or oral form.
- Minimum Necessary Standard: When using, disclosing, or requesting PHI, a CRSS must make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose.
- Permitted Disclosures: HIPAA permits disclosure of PHI without consent for Treatment, Payment, and Healthcare Operations (TPO), as well as specific public health activities or court orders.
Federal Regulation 42 CFR Part 2: SUD Confidentiality
While HIPAA governs general health records, Title 42 of the Code of Federal Regulations Part 2 (42 CFR Part 2) governs records created by federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral for treatment.
Why 42 CFR Part 2 is Stricter than HIPAA:
42 CFR Part 2 was enacted by Congress to ensure that individuals with substance use disorders would not be deterred from seeking treatment out of fear that their records would be used in criminal proceedings, law enforcement actions, or civil litigation.
Core Rules of 42 CFR Part 2:
- No TPO Exception for Disclosures: Unlike HIPAA, 42 CFR Part 2 does not allow automatic disclosure of SUD records to external healthcare providers for treatment or payment without explicit, written consent.
- Prohibition on Redisclosure: Any disclosure made with consent must include a formal written notice stating that the recipient is strictly prohibited from re-disclosing the information to any other party without secondary written authorization.
- Restrictions on Law Enforcement: SUD records protected under Part 2 cannot be used to criminalize, investigate, or prosecute a patient in any criminal investigation or legal proceeding unless a specialized court order meeting stringent Part 2 criteria is issued.
Comparison: HIPAA Privacy Rule vs. 42 CFR Part 2
| Feature | HIPAA Privacy Rule | 42 CFR Part 2 |
|---|---|---|
| Scope | Broad: All Covered Entities handling PHI | Narrow: Federally assisted SUD treatment programs |
| Primary Goal | Standardize health data privacy across US healthcare | Protect SUD patients from criminal prosecution & stigma |
| Treatment Disclosures | Allowed without consent between covered providers for TPO | Requires explicit, written patient consent for external providers |
| Redisclosure Notice | Not mandatory on every document disclosure | Mandatory written notice prohibiting secondary redisclosure |
| Court Subpoenas | Subpoena signed by attorney or judge is generally sufficient | Requires specialized court order demonstrating good cause & no alternative |
| Law Enforcement Use | Permitted under specific statutory exception categories | Strictly prohibited from use in criminal prosecution of the patient |
Components of a Valid Release of Information (ROI)
For a CRSS specialist to share confidential information with external parties (such as family members, probation officers, housing providers, or primary care doctors), a fully compliant written Release of Information (ROI) must be executed.
Under 42 CFR Part 2 and HIPAA regulations, a valid ROI must contain all of the following mandatory elements:
- Name of the Peer: Clearly identifies the individual authorizing disclosure.
- Disclosing Entity: Specific name or organization authorized to disclose the records.
- Recipient Entity: Specific name of the individual or organization authorized to receive the records.
- Description of Information: Precise description of records to be shared (e.g., "Peer Recovery Plans and Attendance Records for 2026").
- Purpose of Disclosure: Explicit reason for sharing information (e.g., "To coordinate housing assistance and community resources").
- Right to Revoke: Explicit statement that the peer can revoke consent in writing at any time.
- Expiration Date/Event: Specific end date or condition (e.g., "Expires on December 31, 2026" or "Upon completion of program").
- Signature and Date: Peer's legal signature (or legal guardian signature) and the date executed.
- Prohibition on Redisclosure Notice: Formal legal warning accompanying the released records.
Modern Updates: CARES Act & 42 CFR Part 2 Alignment
Recent federal updates under the CARES Act aligned certain provisions of 42 CFR Part 2 more closely with HIPAA to simplify care coordination while preserving core protections. Under updated rules, once a peer provides initial written consent for TPO purposes, subsequent redisclosures within an integrated healthcare system for treatment are permitted under HIPAA-like standards, provided the initial consent has not been revoked. However, restrictions preventing the use of SUD records in court or criminal proceedings against the peer remain completely intact.
A housing coordinator calls a CRSS specialist requesting information about a participant's substance use history to verify program eligibility. The participant signed a general HIPAA release for healthcare providers 6 months ago, but no 42 CFR Part 2 ROI naming the housing program exists. What must the peer specialist do?
Which component is strictly required for a Release of Information (ROI) consent form to be considered legally valid under federal 42 CFR Part 2 regulations?
A peer specialist receives a request from an outpatient clinic for a participant's recovery records. The participant has signed a valid ROI authorizing disclosure of 'attendance records only.' The specialist sends attendance records along with the peer's entire personal journal entries containing sensitive trauma history. How does this action violate HIPAA?