Substance Use Disorder & the Medical Record

Authors, Case History, and Commentary

Angelique N. Collamer, MD, MACP
Professor, Department of Clinical Sciences
Texas Christian University, Fort Worth, TX
Clinical Professor of Medicine
Uniformed Services University of the Health Sciences
Bethesda, MD

Elliott J. Crigger, PhD
Senior Associate
Center for Ethics and Professionalism

Editor

Lois Snyder Sulmasy, JD
Director
Center for Ethics and Professionalism
American College of Physicians
Philadelphia, Pennsylvania

Ethics case studies are developed by the American College of Physicians Ethics, Professionalism and Human Rights Committee and the ACP Center for Ethics and Professionalism. The series uses hypothetical examples to elaborate on controversial or subtle aspects of issues in the College's Ethics Manual or other College position statements. The current edition of the ACP Ethics Manual and additional case studies and College policy on ethics, professionalism, and human rights issues are available at https://www.acponline.org/clinical-information/ethics-and-professionalism or by contacting the Center for Ethics and Professionalism at (215) 351-2839.

CASE HISTORY

Alice Johnson, now 33, has struggled with opioid use disorder since her teens. Five years ago, she completed a second residential treatment program and has done well since on oral maintenance therapy with buprenorphine and naloxone. Recently, she was able to complete an associate’s degree in business administration and has relocated to begin a job she found with the help of her college’s placement service. Alice is looking forward to starting over in a new environment.

Alice has enrolled as a new patient in a federally qualified health center that offers behavioral health services, including treatment for substance use disorder, in an integrated primary care model. At her intake visit, she’s given the clinic’s general privacy policy and a one-time consent form to allow information about her SUD treatment to be disclosed for “all future uses and disclosures for treatment, payment, and health care operations.” The accompanying information sheet advises that this consent may allow entities that receive her information to redisclose it without her explicit consent in keeping with the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) (1).

Alice understands that she must own her history of addiction, but as she waits in the exam room for Dr. Green, she becomes more reluctant to sign the consent. She’s uncomfortable with the thought that clinic staff other than her SUD specialist will have access to information that she thought was protected. She explains her discomfort to Dr. Green and asks who will see her personal health information and why it seems her confidentiality is not as protected anymore.

CASE COMMENTARY

The ACP Ethics Manual defines confidentiality as “a fundamental tenet of medical care . . . a matter of respecting the privacy of patients, encouraging them to seek medical care and discuss their problems candidly, and preventing discrimination on the basis of their medical conditions” (2). Dr. Green has the responsibility of addressing Ms. Johnson’s concerns about how her privacy is protected under the new rules. Helping Ms. Johnson understand why the rules were updated and what protections they offer will be important in building trust and an effective relationship with her patient.

Substance Use Disorder: The Evolution of Privacy Protections

Historically, privacy regulations in the US offered special protections for sensitive and potentially stigmatizing personal information, including diagnosis or treatment for a substance use disorder. Rules promulgated in the 1970s protected the information of patients who were assessed or treated for an SUD in a federally funded health care setting by a substance abuse specialist by requiring the patient’s written authorization for each disclosure of information to health care professionals in other treatment settings (3). However, the same protection did not extend to records created during assessment or treatment by non-SUD specialists outside of Part 2 programs, for example short-term interventions in primary care or emergency departments, leading to confusion among nonspecialist health professionals and organizations (4).

In response to the opioid use disorder (OUD) epidemic and associated increases in infectious diseases (ID) in the 2010s, the National Academies of Science, Engineering, and Medicine was tasked with identifying barriers to integrating OUD and ID services and providing recommendations to promote integrated, patient-centered programs (4). One such barrier, the ensuing report noted, was the lack of data integration and sharing across SUD and primary care programs. Privacy protections originally intended to “encourage individuals with SUD to seek treatment without the fear of their SUD becoming known outside of the treatment context, so that they need not risk arrest, loss of guardianship/parental rights, or discrimination in employment or insurance contexts” in this new context were burdensome and inhibited effective coordination of treatment for OUD and IDs.

In its 2020 report, while recognizing the ongoing importance of protecting privacy, NASEM recommended that 42 CFR Part 2 should “either further align with the Health Insurance Portability and Accountability Act (HIPAA) or alter the definition of which specific service delivery programs” fall under the Part 2 rules (6). Amendments to 42 CFR Part 2 issued in February 2024 accomplish the recommended alignment with HIPAA (1).

Privacy and Confidentiality under the New Part 2 Rules 

What does this mean for patients like Ms. Johnson? Dr. Green could begin by briefly explaining the rationale for the change to the privacy rules. For example, by aligning Part 2 rules more closely with HIPAA, the changes make it easier to share information for clinical care. Instead of requiring patients to consent for disclosures to different practitioners, the new rules allow a single, revocable consent for all future uses and disclosures for treatment, payment, and health care operations. The rules allow HIPAA covered entities and business associates that receive records under this consent to redisclose the records in accordance with HIPPA protections. At the same time, however, entities must be able to retrieve the record if the patient revokes consent. Any disclosure must be limited to only the information necessary to accomplish the purpose for which the information is requested. 

Dr. Green could inform Ms. Johnson that she can request that use or disclosure of her information be restricted, even if she’s signed a general consent, although—with certain exceptions—the program is not required to agree to a restriction. The program must honor the patient’s request when the use/disclosure would be for purposes of treatment, payment or health care operations and the record pertains to a service for which the patient (or someone on their behalf) has paid in full. Dr. Green should also inform Ms. Johnson that the rules permit disclosure without her consent for certain purposes, such as public health reporting or when the information is needed to provide emergency treatment for her.

Dr. Green should assure Ms. Johnson that counseling notes taken during her time in treatment require separate consent before they can be disclosed. Sharing SUD clinician notes that document the conversation in an SUD treatment session that the clinician voluntarily maintains separately from the rest of the patient’s SUD treatment and medical record require specific consent from the individual. These clinician notes cannot be used or disclosed based on a broad consent to disclosure for treatment, payment, and health care operations.

Dr. Green could also note that the new rules adopt patient rights consistent with HIPAA, e.g., the right to restrict disclosure, to request an accounting of disclosures (within a 3-year time limit, compared to 6 years for records under HIPAA), and to notification of breaches, which are now subject to enforcement by the Office of Civil Rights. The rules also explicitly restrict “the use of records and testimony in civil, criminal, administrative, and legislative proceedings against patients, absent patient consent or a court order” (7). 

Conclusion: Better Integrated Care

By providing privacy protections for SUD-related information across health care settings that are consistent with HIPAA, the new Part 2 rules remove an important barrier to access to SUD treatment outside the limited number of federally funded SUD treatment programs under uniform protections for confidentiality.  Similar to Dr. Green’s conversation with Alice, treating practitioners should explain to patients that the new rules enable them to receive primary health care and treatment for SUD through the FQHC, enhance patient safety, and support coordinated, high quality care.

Substance Use Disorder and clinical care teams should also stress the ethical commitment of health care professionals, and the institution, to protect patient privacy and confidentiality.  For example, Dr. Green could describe for Ms. Johnson the privacy “culture” of the FQHC, including relevant policies and practices, how potential breaches of confidentiality are handled, and the expectations staff hold of one another to protect patients’ interests. Clinics should have also indicated how Ms. Johnson can raise concerns if she feels her confidentiality has been compromised. 

Coda

After Alice leaves, Dr. Green finds herself thinking about their conversation and about a former patient.

Nathan had come to her with severe painful arthritis. “I prescribed tramadol,” Dr. Green remembers, “not knowing he’d been treated for heroin addiction many years before I saw him.” Nathan hadn’t disclosed his previous treatment.  He followed her instructions—and subsequently developed cravings for the medication. Nathan had difficulty stopping the medication. 

“If the new Part 2 rules about disclosure had been in place,” Dr. Green sighs, “the prior diagnosis would have made it onto Nathan’s problem list and things could have turned out differently.  I’m glad I advised Alice that the new Part 2 rules are to help her care team make the best management and treatment decisions for her possible.”

Claim CME Credits and MOC Points

REFERENCES

1. Health Insurance Portability and Accountability Act. Pub. L. No. 104-191, § 264, 110 Stat.1936.

2. Sulmasy LS, Bledsoe TA, for the ACP Ethics, Professionalism and Human Rights Committee. American College of Physicians ethics manual, seventh edition. Ann Intern Med. 2019;170:S1–S32. 

3. Manuel JK, Newville H, Larios SE, Sorensen JL. Confidentiality protections versus collaborative care in the treatment of substance use disorders. Addict Sci Clin Pract. 2013:8:13. Accessed at http://www.ascpjournal.org/content/8/1/13. February 13, 2025.

4. Campbell ANC, McCarty D, Rieckmann T, et al. Interpretation and integration of the federal substance use privacy protection rule in integrated health systems: a qualitative analysis. J Subst Use Addict Treat. 2019;97:41–46.

5. Springer SA, Merluzzi AP, del Rio C. Integrating responses to the opioid use disorder and infectious disease epidemics: a report from the National Academies of Sciences, Engineering and Medicine. JAMA 2020;324:37–38.

6. National Academies of Sciences, Engineering, and Medicine. Opportunities to Improve Opioid Use Disorder and Infectious Disease Services: Integrating Responses to a Dual Epidemic. Washington, DC: The National Academies Press; 2020. Accessed at https://doi.org/10.17226/25626. February 13, 2025.

7. Department of Health and Human Services. Fact Sheet 42 CFR Part 2 Final Rule. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html. Accessed April 24, 2025.