HIPAA-Compliant Substance Use Disorder Record Redisclosure Policy Template for Integrated Primary Care Clinics

Policy template: [Clinic name] will protect substance use disorder records covered by 42 CFR Part 2 and disclose or redisclose them only when permitted by Part 2, HIPAA, and applicable state law. Adapt this template to your clinic’s services, records, consent forms, and workflows; have your privacy officer or legal counsel review it before adoption.

Part 2 applies to federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment. A general medical clinic is not automatically a Part 2 program simply because it treats patients with SUD or receives Part 2 records. A clinic may, however, hold Part 2 records received through a permitted disclosure and must follow the restrictions that apply to its use of those records. See 42 CFR § 2.11 and 42 CFR § 2.12.

What Does Part 2 Allow Under a Single TPO Consent?

A patient may sign one written TPO consent that permits future uses and disclosures of Part 2 records for treatment, payment, and health care operations. A Part 2 program may use and disclose records within that consent’s scope, and a covered entity or business associate that receives records for TPO may redisclose them as HIPAA permits, subject to Part 2’s restriction on proceedings against the patient. See 42 CFR § 2.31, 42 CFR § 2.33, and the HHS Part 2 Final Rule fact sheet.

Policy: Before relying on a TPO consent, [clinic name] will verify that it is valid, current, signed by the patient or an authorized representative, and sufficiently specific to cover the records, recipient, and purpose. Staff will honor any known revocation and any applicable restriction. A general medical-record release is not a substitute for a Part 2 consent that meets the regulation’s requirements.

A compliant consent identifies the patient; the person or class authorized to disclose; the information to be disclosed; the recipient or recipient class; the purpose; how the patient may revoke; and an expiration date or event. For a single future TPO consent, “for treatment, payment, and health care operations” is an allowed purpose description, and the recipient may be described using an allowed general designation. The consent must also explain that the information may be redisclosed and may no longer be protected by Part 2, and state the consequences of refusing to sign.

When the consent authorizes disclosure to a HIPAA covered entity or business associate for TPO, it must also state that the recipient may redisclose the records as HIPAA permits, except for uses or disclosures in civil, criminal, administrative, or legislative proceedings against the patient.

Suggested TPO consent language for clinic review

“I consent to [Part 2 program or authorized disclosing person] disclosing [specific records or categories of records] to my treating providers, health plans, third-party payers, and people helping to operate the program for treatment, payment, and health care operations. If a recipient is a HIPAA covered entity or business associate, the recipient may redisclose the records as permitted by HIPAA, except for proceedings against me described in 42 CFR Part 2. The information may be redisclosed and may no longer be protected by Part 2. I may revoke this consent in writing by contacting [contact details], except to the extent action has already been taken in reliance on it. This consent expires [date or event]. Refusing to sign may affect [accurate, clinic-specific consequences].”

This sample is not a substitute for a consent form that includes every required element, signature, date, and any state-law requirements. A patient’s consent for a proceeding against them must be separate from a consent for other purposes.

When May HIPAA-Covered Recipients Redisclose Part 2 Records?

A HIPAA covered entity or business associate that receives Part 2 records for treatment, payment, or health care operations under a valid consent may use and redisclose them in accordance with HIPAA. The key exception is that the recipient may not use or disclose the records in proceedings against the patient unless the patient gives the required specific consent or a qualifying Part 2 court order authorizes it. See 42 CFR § 2.33.

Policy: [Clinic name] will check the source and scope of a Part 2 disclosure before using or redisclosing the information. Staff will apply HIPAA’s permitted-use requirements, any patient restrictions the clinic has agreed to honor, applicable state law, and any more protective contractual terms. Staff will not assume that receiving records for one purpose permits every use or disclosure.

The broader HIPAA redisclosure permission applies to covered entities and business associates within the rule’s conditions. A recipient that is not a covered entity or business associate must follow the applicable Part 2 limits and the consent’s scope; it should not assume HIPAA’s TPO redisclosure permission applies to it.

What Must Accompany a Consent-Based Disclosure?

Each disclosure made with a patient’s written consent must include a written Part 2 notice and either a copy of the consent or a clear explanation of its scope. The notice may use the detailed statement in 42 CFR § 2.32(a)(1) or the shorter permitted statement: “42 CFR part 2 prohibits unauthorized use or disclosure of these records.” A general authorization to release medical information does not satisfy Part 2’s consent requirements.

Policy: For every disclosure made with written consent, [clinic name] will attach or transmit the required Part 2 notice and provide either the consent itself or a clear, accurate explanation of what it authorizes. Staff will use a secure method, confirm the intended recipient, and record the disclosure according to clinic procedures.

The requirement applies to each disclosure made with written consent. It does not mean that a copy of the original consent must accompany every later disclosure that a covered entity or business associate makes independently under HIPAA rather than on the basis of that written consent. When the disclosure’s legal basis is unclear, staff must pause and consult the privacy officer.

How Should Clinics Handle Part 2 Records in Integrated Medical Records?

Part 2 does not require a clinic to segregate or segment records received under a valid TPO consent. A covered entity or business associate may integrate those records into its medical record system and manage them under HIPAA, subject to the continuing Part 2 restriction on proceedings against the patient and any applicable state-law limits. See 42 CFR § 2.12 and the HHS Part 2 Final Rule fact sheet.

Policy: [Clinic name] may store properly received Part 2 records in the patient’s integrated chart. The clinic will use role-based access, workforce training, secure transmission, and other reasonable safeguards to protect patient information. It may use labels or access controls to support these safeguards and prevent prohibited uses, even though Part 2 does not require record segmentation.

Integration does not expand the consent’s scope or override a stricter state law, valid restriction, or other applicable legal limit. The clinic will document any agreed restriction and communicate it to staff and service providers who need to know it.

What Consent Rules Apply to Counseling Notes and Legal Proceedings?

SUD counseling notes. SUD counseling notes are a clinician’s notes analyzing a counseling conversation that the clinician voluntarily maintains separately from the rest of the patient’s SUD treatment and medical record. These notes are not covered by a broad TPO consent: Part 2 generally requires separate, specific written consent for their use or disclosure, subject to limited regulatory exceptions. A consent for these notes may be combined only with another consent for SUD counseling notes, and a Part 2 program may not condition treatment or benefits on signing it. See 42 CFR § 2.31(b) and the HHS Part 2 Final Rule fact sheet.

Proceedings against a patient. A TPO consent does not authorize use of Part 2 records against a patient in a civil, criminal, administrative, or legislative investigation or proceeding. The patient must provide a separate, specific written consent for that purpose, or the records must be covered by a Part 2 court order and subpoena or similar legal mandate. A subpoena alone is not enough. See 42 CFR § 2.31(d), 42 CFR § 2.61, 42 CFR § 2.64, and 42 CFR § 2.65.

Policy: Staff who receive a subpoena, court order, warrant, or other legal demand involving Part 2 records will promptly refer it to [privacy officer or legal counsel]. Staff will not disclose records or provide testimony about them until the appropriate review confirms that a valid consent or Part 2-compliant court order and compulsory process authorize the disclosure.

Which Disclosures Are Permitted Without Consent?

Part 2 permits certain limited disclosures without patient consent, but a general HIPAA permission does not by itself create a Part 2 exception. Staff must identify and document the specific legal basis before disclosing identifiable records.

• Medical emergencies: Patient-identifying information may be disclosed to medical personnel to the extent necessary to meet a bona fide medical emergency when prior written consent cannot be obtained. The Part 2 program must document the recipient and affiliation, the person making the disclosure, the date and time, and the nature of the emergency. See 42 CFR § 2.51.
• FDA product-safety notices: A Part 2 program may disclose identifying information to FDA medical personnel who assert that a product-related error may threaten health, solely to notify patients or their physicians of potential dangers. See 42 CFR § 2.51.
• Public health: A Part 2 program may disclose records to a public health authority without consent only when the information has been de-identified under the HIPAA standard. See 42 CFR § 2.54.
• Research, audit, or evaluation: Part 2 provides limited pathways for these activities, subject to specific eligibility, written-agreement, privacy, and use restrictions. They are not blanket permissions to share identifiable records for ordinary clinic operations. See 42 CFR § 2.52 and 42 CFR § 2.53.
• Internal program activities and qualified service organizations: Part 2 allows certain communications within a program or with an entity having direct administrative control, and certain disclosures to qualified service organizations under the required agreement. The scope and conditions of the applicable exception still apply. See 42 CFR § 2.12.
• Suspected child abuse or neglect: Part 2 does not bar a report of suspected child abuse or neglect when state law requires it. That reporting exception does not itself authorize disclosure of Part 2 records for later investigation or proceedings. See 42 CFR § 2.12(c)(6).

Policy: If staff cannot identify a clear Part 2 exception, they will not disclose identifiable Part 2 information without valid consent or legal review. They will document the applicable exception, the information disclosed, the recipient, and any required follow-up.

How Should Clinics Address Patient Notices, Safeguards, and Breach Reporting?

Part 2 programs must provide patients a notice describing Part 2 confidentiality requirements, patient rights, and the program’s privacy practices. HIPAA covered entities that create or maintain Part 2 records must address those records in their Notice of Privacy Practices. A Part 2 program that is also a HIPAA covered entity may use a combined notice if it satisfies both sets of requirements. HHS provides updated model HIPAA and Part 2 notices.

Policy: [Clinic name] will make the applicable notice available to patients, update it when required, and explain how patients may ask questions or raise privacy concerns. The clinic will use reasonable safeguards to prevent unauthorized use or disclosure, including appropriate workforce access, secure handling, and incident-escalation procedures. Part 2’s security requirements are set out in 42 CFR § 2.16.

If an incident may involve unsecured Part 2 records, staff must notify [privacy officer] promptly. The privacy officer will assess the incident, preserve relevant information, mitigate harm, and determine which Part 2 and HIPAA breach-notification duties apply. Part 2 programs must notify affected individuals and the Secretary for breaches of unsecured Part 2 records, with media notice when required; reporting deadlines follow the applicable rules. See HHS guidance on reporting HIPAA and Part 2 breaches.

Policy summary: Use a valid, appropriately scoped consent for consent-based sharing; include the required Part 2 notice and consent scope with each disclosure made under written consent; apply HIPAA redisclosure rules only when their conditions are met; and stop for privacy or legal review when counseling notes, legal demands, or uncertain exceptions are involved.

FAQs.

Can a patient use one consent for future treatment, payment, and health care operations?

Yes. A patient may provide one written consent for future TPO uses and disclosures. The consent must meet Part 2’s requirements, including identifying the records, discloser, recipient or permitted recipient class, purpose, expiration, and revocation method, and it must include the required statements about redisclosure and refusal. 42 CFR § 2.31.

Must a copy of the consent accompany every consent-based disclosure?

Each disclosure made with the patient’s written consent must include either a copy of the consent or a clear explanation of its scope, along with one of the written Part 2 notices. The notice may use the detailed statement or the shorter statement allowed by the regulation. 42 CFR § 2.32.

Can Part 2 records be stored with other clinic records?

Yes. Part 2 does not require a covered entity or business associate to segregate or segment records received under a valid TPO consent. The clinic must still protect the records and follow applicable HIPAA rules, Part 2 restrictions, patient restrictions it has agreed to honor, and stricter state-law requirements. 42 CFR § 2.12.

What authorization is required to use Part 2 records in a proceeding against a patient?

The clinic needs a separate, specific written consent from the patient for the proceeding or a Part 2-compliant court order accompanied by a subpoena or similar legal mandate. A subpoena alone, or a general TPO consent, does not authorize the disclosure. Refer all legal demands to the privacy officer or legal counsel before releasing records or providing testimony. 42 CFR § 2.31 and 42 CFR § 2.61.