HIPAA Compliance Guide for Inpatient Addiction Consult Services

What HIPAA rules apply to inpatient addiction consult services?

HIPAA generally applies to hospitals and clinicians that are covered entities, as well as business associates handling protected health information (PHI) for them. Whether a particular inpatient addiction consult service is also subject to 42 CFR Part 2 depends on whether it is part of a federally assisted program providing substance use disorder (SUD) diagnosis, treatment, or referral for treatment. A note mentioning substance use is not automatically a Part 2 record; the program and record’s connection to it matter. See HHS’s Part 2 overview and the HHS explanation of who must comply with HIPAA.

For records covered by both laws, teams must follow HIPAA and Part 2 together. Part 2 adds limits on disclosures and use of records in proceedings against a patient. The 2024 Part 2 final rule’s compliance date was February 16, 2026; consult the HHS fact sheet on the final rule for its current requirements.

HIPAA generally permits covered entities to use or disclose PHI for treatment, payment, and health care operations without a separate HIPAA authorization, subject to applicable requirements. A disclosure of Part 2 records must also meet Part 2’s rules, including any consent requirements that apply.

How should teams handle consent and disclosures under 42 CFR Part 2?

When Part 2 applies, do not assume that a routine HIPAA treatment disclosure is enough. A Part 2 program may obtain a single written or electronic consent covering future treatment, payment, and health care operations disclosures. The consent must meet Part 2’s requirements, including identifying the patient, the information, authorized disclosers, recipients or recipient categories, purpose, expiration, and the patient’s right to revoke. See 42 CFR § 2.31 and 42 CFR § 2.33.

When a covered entity or business associate receives Part 2 records under a valid TPO consent, it may generally redisclose them as HIPAA permits. That permission does not allow the records to be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient, except as Part 2 allows. Each consent-based disclosure must include a copy of the consent or a clear explanation of its scope.

Part 2 also permits a limited disclosure to medical personnel to address a bona fide medical emergency when prior written consent cannot be obtained. The Part 2 program must document the emergency disclosure promptly, including who received and made it, when it occurred, and the nature of the emergency. See 42 CFR § 2.51. Route subpoenas, law-enforcement requests, and other unusual disclosure demands to the hospital privacy office or legal counsel rather than treating them as ordinary clinical requests.

How can clinicians document addiction consults in the electronic health record?

Document the clinical information needed to support safe, coordinated care: the reason for consultation, relevant findings, assessment, recommendations, communication with the treating team, and follow-up plan. Use clear, objective language and distinguish patient-reported information from observed findings. HIPAA does not prescribe a special note template for addiction consultations, so teams should follow hospital documentation policy and applicable professional standards.

Do not label routine consultation documentation as psychotherapy notes merely because it concerns behavioral health or substance use. HIPAA defines psychotherapy notes narrowly: they are a mental health professional’s notes analyzing counseling conversations that are kept separate from the rest of the medical record. They do not include ordinary clinical summaries such as diagnoses, treatment plans, symptoms, or progress notes maintained in the medical record. See HHS guidance on psychotherapy notes.

Part 2 separately protects certain SUD counseling notes that analyze counseling conversations and are maintained apart from the rest of the SUD treatment and medical record; these require specific consent and cannot be disclosed under a broad TPO consent. Keep documentation in the appropriate part of the record and consult privacy or health-information management staff when classification is uncertain. Part 2 does not require organizations to segregate or segment Part 2 records, although a hospital may use EHR controls to support its privacy practices.

What safeguards protect substance use disorder records from unauthorized access?

Apply the hospital’s risk-based administrative, physical, and technical safeguards to electronic PHI. Useful controls include role-based access control, unique user accounts, authentication, access reviews, audit logs, secure workstations, and prompt removal or revision of access when staff roles change. The HIPAA Security Rule requires covered entities and business associates to implement reasonable and appropriate safeguards; see HHS’s Security Rule summary and the technical safeguards in 45 CFR § 164.312.

Set permissions according to job responsibilities and the hospital’s risk assessment, and monitor access for unusual activity. HIPAA’s minimum necessary standard generally applies to uses, requests, and disclosures for payment and health care operations, but it does not apply to provider-to-provider disclosures or requests for treatment. Part 2 has its own requirement that uses and disclosures of Part 2 records be limited to information necessary for their purpose. See HHS’s minimum necessary guidance and 42 CFR § 2.13.

Use audit trails to support monitoring and investigations, and protect records in all formats—not only in the EHR. Part 2 requires programs and most lawful holders to maintain policies and procedures addressing the secure handling, access, transmission, and destruction of covered records. See 42 CFR § 2.16.

How should teams respond to patient requests and record corrections?

Direct requests for access, copies, confidential communications, or amendments to the hospital office designated to handle them. Under HIPAA, patients generally may access PHI in a designated record set, though psychotherapy notes and certain other records are excepted from the access right. A covered entity generally must act on an access request within 30 calendar days; one extension of up to 30 additional days is allowed when the required notice is given on time. See 45 CFR § 164.524 and HHS guidance on access-request timelines.

A patient may request an amendment to PHI in a designated record set. The hospital may deny a request on grounds allowed by HIPAA, such as when it determines that the information is accurate and complete, but it must follow the required response process. The general response deadline is 60 days, with one extension of up to 30 days if the patient receives the required notice. If the hospital denies the request, explain the decision and the patient’s available options, including submitting a statement of disagreement. See 45 CFR § 164.526.

Do not delete or silently overwrite an existing clinical entry to resolve a disagreement. Follow the EHR’s amendment or addendum process so the record’s history remains clear. Apply any additional Part 2 or state-law requirements that govern the particular record and request.

What should staff do after a suspected privacy breach?

Report suspected unauthorized access, use, or disclosure promptly through the hospital’s established privacy or security incident process. Staff should preserve relevant records and audit logs, avoid further disclosure, and follow instructions from the privacy and security teams. The hospital should investigate the facts, contain the incident, mitigate harm where practicable, and document its response. The HIPAA Security Rule requires policies and procedures to identify and respond to suspected or known security incidents and to document incidents and outcomes; see HHS guidance on security-incident procedures.

The privacy office—not the individual staff member who first reports the issue—should assess whether the event is a reportable breach. HIPAA generally presumes an impermissible use or disclosure to be a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised. The assessment considers the information involved, who received it, whether it was viewed or acquired, and what mitigation occurred. See the HHS Breach Notification Rule guidance.

For a breach of unsecured PHI, required notices generally must be made without unreasonable delay and no later than 60 days after discovery. HIPAA also requires notice to HHS, and a breach affecting more than 500 residents of a state or jurisdiction requires notice to prominent media outlets. Part 2 applies HIPAA breach-notification requirements to breaches of unsecured Part 2 records. Follow the hospital’s incident-response plan and privacy-office direction for determining who must notify affected people and regulators.

How do state laws and hospital policies affect disclosure requirements?

HIPAA provides a federal baseline, but a state law that provides greater privacy protection or stronger individual rights may apply instead of a conflicting HIPAA rule. Other state laws may require particular reports or disclosures, and the HIPAA Privacy Rule allows disclosures that are required by law, subject to the applicable limits. Because state rules vary, check the law for the relevant jurisdiction and the specific record type before responding to a nonroutine request. See HHS guidance on HIPAA and state-law preemption.

Hospital policies should translate applicable requirements into practical procedures for consent verification, access permissions, documentation, patient requests, and incident escalation. A policy may set tighter internal controls, but it does not replace the legal review needed when laws, consent terms, or emergency circumstances affect a proposed disclosure. When requirements are unclear or potentially conflict, consult the privacy officer or legal counsel.

In summary: Determine whether HIPAA and Part 2 apply to the service and records, verify the authority for each disclosure, document clinically relevant information appropriately, restrict and monitor access, and escalate unusual requests or suspected breaches through established hospital channels.

FAQs.

Does HIPAA require separate consent to share substance use disorder treatment records?

HIPAA generally does not require a separate authorization for treatment disclosures between providers. If the records are protected by Part 2, a valid Part 2 consent may be required; Part 2 now permits a single consent for future treatment, payment, and health care operations disclosures. A Part 2 medical-emergency exception may also apply when its conditions are met.

How does 42 CFR Part 2 affect disclosures between hospital clinicians?

Part 2 can impose additional consent and confidentiality requirements when the records come from a Part 2 program or otherwise qualify as Part 2 records. A valid TPO consent can permit disclosures and later redisclosures by HIPAA-regulated recipients as HIPAA allows, but not use of the records in proceedings against the patient except as Part 2 permits. For a medical emergency where prior written consent cannot be obtained, a limited disclosure to medical personnel may be allowed under Part 2’s emergency rule.

Can inpatient addiction consult notes be restricted in the electronic health record?

Yes. A hospital may configure role-based permissions or other access controls in accordance with its policies and risk assessment. Part 2 does not require records to be segmented, and the fact that a note concerns addiction does not by itself make it a psychotherapy note or a Part 2 record.

What steps should a hospital take after an unauthorized disclosure?

Staff should promptly report it through the hospital’s incident process and preserve relevant information. The privacy and security teams should investigate, contain the incident, mitigate harm, document their findings, and determine whether HIPAA or Part 2 breach notifications are required. Required HIPAA notices for breaches of unsecured PHI are generally due without unreasonable delay and no later than 60 days after discovery.