HIPAA Training for ED Addiction Bridge Program Staff

Emergency department (ED) addiction bridge teams help connect patients with substance use disorder (SUD) care while protecting sensitive health information. Your day-to-day responsibilities depend on whether your ED, bridge service, or a partner organization is a HIPAA-covered entity, a 42 CFR Part 2 program, or both.

Use this overview alongside your employer’s privacy policies and instructions from its privacy officer. HIPAA requires covered entities to train workforce members on relevant privacy policies and document that training; a training completion certificate does not certify that an organization is HIPAA-compliant. Federal HIPAA rules do not set a universal annual certificate-renewal schedule, although your employer may require recurring training. See 45 CFR § 164.530 and HHS guidance on HIPAA training and compliance claims.

When HIPAA and 42 CFR Part 2 apply to ED bridge program staff

HIPAA applies to covered entities—such as qualifying health care providers—and their business associates. If your ED or health system is a covered entity, its workforce members must follow the organization’s HIPAA policies when using or disclosing protected health information. HIPAA can protect SUD-related information even when the record is not covered by Part 2.

Part 2 adds protections to certain records that identify a patient as having, having had, or being referred for an SUD. It applies when the records are connected with a federally assisted SUD program and concern diagnosis, treatment, or referral for treatment. The current Part 2 regulation defines both the program and the records covered.

An ED can have a general emergency service and a distinct bridge program with different Part 2 status. Your role or job title alone does not settle the question. Confirm which service created or holds the record, whether it qualifies as a Part 2 program, and what your employer’s policy requires before disclosing information.

Part 2’s 2024 final rule has been in effect since April 16, 2024, and its compliance date was February 16, 2026. HHS describes the updated requirements in its Part 2 Final Rule fact sheet.

How to determine whether an addiction bridge service is a Part 2 program

Use the regulation’s definition rather than assuming that every SUD-related service is a Part 2 program. A program generally must provide SUD diagnosis, treatment, or referral for treatment and be federally assisted. A qualifying program may be a stand-alone service, an identified unit within a general medical facility, or identified medical personnel whose primary function is providing those services.

Federal assistance can include direct or indirect federal funding, certain federal licenses or authorizations, Medicare participation, and qualifying tax-exempt status. A patient’s individual federal funding, by itself, does not make a private program federally assisted. The applicable definitions and examples appear in 42 CFR §§ 2.11–2.12.

The regulation specifically distinguishes ordinary emergency care from a designated SUD program: ED personnel who refer a patient with an apparent overdose to intensive care are not, for that reason alone, a Part 2 program. The analysis may differ if the ED has promoted itself as providing SUD services or if an identified unit or staff group primarily provides SUD diagnosis, treatment, or referral for treatment. See 42 CFR § 2.12(e).

Ask the privacy officer or legal/compliance team to assess the service’s structure, responsibilities, public identification, funding, and records. Do not independently declare a bridge program exempt from Part 2 because it is located inside a hospital or receives patients through the ED.

When emergency treatment permits limited disclosure of Part 2 records

The medical emergency disclosure exception is narrow. A Part 2 program may disclose patient-identifying information to medical personnel only to the extent necessary to address a bona fide medical emergency when the patient’s prior written consent cannot be obtained. It is not a general exception for routine coordination, convenience, or non-urgent follow-up.

After the disclosure, the Part 2 program must document it in the patient’s record. The documentation must identify the medical personnel and their health care facility, the person who made the disclosure, the date and time, and the nature of the emergency. These requirements are set out in 42 CFR § 2.51.

For staff, the practical rule is to share only what responding medical personnel need for the emergency, use an approved communication channel, and follow the program’s documentation process. If you receive Part 2 records during emergency care, do not assume that the emergency exception permits later disclosures to other people or for unrelated purposes; check the applicable consent, law, and organizational policy.

How to obtain consent and manage redisclosure

When Part 2 requires consent, use the approved Part 2 written consent form, not a generic release or informal verbal permission. A valid consent identifies the patient, the person or class authorized to disclose, the information, the recipient or permitted recipient class, and the purpose, along with other required statements. The regulation permits paper or electronic consent and allows a single consent for future treatment, payment, and health care operations disclosures when its requirements are met. See 42 CFR § 2.31.

A patient may provide a single treatment, payment, and health care operations (TPO) consent. When a Part 2 program discloses records under that consent to a HIPAA-covered entity or business associate for those purposes, the recipient may generally redisclose them as HIPAA permits. That permission does not allow use or disclosure in civil, criminal, administrative, or legislative proceedings against the patient. See 42 CFR § 2.33.

Each disclosure made with written consent must include a copy of the consent or a clear explanation of its scope, along with the required Part 2 notice. The notice explains that Part 2 restricts unauthorized use or disclosure and limits proceedings against the patient. A general authorization alone is not enough to satisfy the Part 2 consent requirements. See 42 CFR § 2.32.

Do not assume that every recipient can redisclose records under HIPAA. A recipient that is not a HIPAA-covered entity or business associate remains subject to the applicable Part 2 restrictions. SUD counseling notes that meet the regulatory definition also require separate consent; a broad TPO consent does not cover those notes. When a patient revokes consent or the proposed disclosure falls outside its scope, pause and ask your privacy officer how to proceed.

What staff must know about legal proceedings involving patient records

A subpoena alone does not authorize disclosure of Part 2 records. Generally, a valid Part 2 court order must authorize the disclosure, and a subpoena or similar legal mandate must also compel it. The court order permits disclosure but does not, by itself, compel the holder to produce records. See 42 CFR § 2.61.

Part 2 restricts use of covered records in proceedings against a patient unless the patient gives the required consent or a court order authorizes the use or disclosure under Part 2. Do not confirm that someone is a patient, search for records at a requester’s direction, or send records directly to law enforcement or a court based only on a subpoena, warrant, or informal request.

Send legal demands immediately to the designated privacy, legal, or records-management contact. Preserve the request and any relevant records, do not make an independent disclosure decision, and follow instructions about deadlines, notice, and the specific records authorized for release. The relevant court procedures and criteria appear in 42 CFR Part 2, Subpart E.

Required privacy notices and breach reporting responsibilities

Part 2 programs must inform patients that federal law protects the confidentiality of SUD records and provide a plain-language notice describing the program’s privacy practices and patient rights. This generally occurs at admission; if a patient lacks capacity at admission, the program provides the information when the patient later has capacity. HIPAA-covered providers and health plans that create or maintain Part 2 records must also include the required SUD information in their Notice of Privacy Practices. HHS explains the updated requirements and provides model privacy notices.

A possible breach of unsecured Part 2 records must be reported through your employer’s privacy or security incident process immediately. Do not wait to determine on your own whether notification is required, and do not delete messages or records that may help the organization assess what happened. Record the known facts, follow instructions to contain the incident, and share information only with the response team.

Part 2 programs must follow HIPAA Breach Notification Rule procedures for breaches of unsecured Part 2 records. Depending on the circumstances, notices may be required to affected individuals, the Secretary of HHS, and the media. Generally, individual notice is due without unreasonable delay and no later than 60 days after discovery; HHS reporting timelines vary by the number of people affected. See 42 CFR § 2.16 and HHS guidance on reporting Part 2 breaches to the Secretary.

Practical scenarios for handling substance use disorder information

• An ED clinician treats an apparent overdose. Routine overdose care does not automatically make the clinician or the entire ED a Part 2 program. Follow HIPAA and ED policy, and check whether the information came from a separate Part 2 program before redisclosing it.
• A patient cannot provide consent during an emergency. If you are disclosing from a Part 2 program, share only what medical personnel need to address the bona fide emergency and ensure the required disclosure details are documented afterward.
• A bridge clinician requests records from a Part 2 treatment program. Use the approved consent process or confirm another specific Part 2 permission applies. Check the recipient, purpose, scope, and required redisclosure notice before sending records.
• Law enforcement presents a subpoena. Do not release or confirm records based on the subpoena alone. Refer the demand to the designated legal or privacy contact for review of the Part 2 court-order and subpoena requirements.
• A message containing SUD information goes to the wrong recipient. Report it promptly through the incident process, preserve relevant details, and follow instructions from the privacy or security response team. The organization—not the individual staff member acting alone—assesses notification duties.

For each scenario, share only information you are authorized to disclose, use approved systems, and document actions as your organization’s policy requires. State law and employer-specific rules may impose additional limits, so consult your privacy officer when the correct path is unclear.

FAQs.

Does 42 CFR Part 2 apply to every ED addiction bridge program?

No. Part 2 applies when the program meets the federal definition of a federally assisted SUD program and the records meet the regulation’s criteria. An ordinary ED encounter or overdose referral does not automatically make the ED a Part 2 program, but an identified bridge unit or staff group may qualify depending on its function, identification, and federal assistance. Confirm the status with your organization’s privacy or compliance office.

When can staff disclose Part 2 records during a medical emergency?

A Part 2 program may disclose patient-identifying information to medical personnel only as needed for a bona fide medical emergency when the patient’s prior written consent cannot be obtained. The program must document the recipient, disclosing person, date and time, and nature of the emergency after the disclosure. See 42 CFR § 2.51.

Can a HIPAA-covered recipient redisclose records received under Part 2?

Generally, a HIPAA-covered entity or business associate that receives Part 2 records under a qualifying consent for treatment, payment, or health care operations may redisclose them as HIPAA permits. It may not use or disclose the records in proceedings against the patient based on that permission. Other recipients may remain subject to Part 2 restrictions, so check the consent and accompanying notice.

What must staff do if unsecured Part 2 records are breached?

Report the suspected incident immediately through your organization’s privacy or security process, preserve relevant information, and follow directions to contain it. Do not decide on your own whether the event is a reportable breach or notify patients or outside parties unless authorized. The Part 2 program is responsible for applying the breach-notification rules and coordinating required notices.

In short, identify whether HIPAA, Part 2, or both apply before sharing SUD information; use the correct consent or limited exception; treat legal demands and possible breaches as matters for the designated privacy team; and follow your employer’s procedures.