HIPAA Training for Inpatient Addiction Consult Service Staff

What HIPAA requires when handling addiction treatment information

Inpatient addiction consult teams handle protected health information (PHI), including information about diagnoses, medications, consultations, and treatment plans. If your hospital is a HIPAA covered entity, its workforce must follow the HIPAA Privacy, Security, and Breach Notification Rules and the hospital’s own privacy and security policies.

HIPAA generally permits providers to use and disclose PHI for treatment, payment, and health care operations without a separate HIPAA authorization. But additional protections may apply to substance use disorder patient records under 42 CFR Part 2. Part 2 applies to federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment; whether a record is covered depends on the program and record context, not simply on the presence of an SUD diagnosis in a hospital chart.

Part 2’s updated rule has been effective since April 16, 2024, and compliance was required by February 16, 2026. Staff should follow the hospital’s current procedures for identifying Part 2 records and handling information received from a Part 2 program. When the source or rules are unclear, check with the privacy officer before disclosing the information.

HIPAA requires covered entities to train workforce members on privacy policies and procedures as necessary and appropriate for their roles. Complete the employer-specific training assigned to you and follow local policy; a training completion certificate does not establish that an organization is HIPAA compliant. Federal HIPAA rules do not create a universal annual certificate-renewal requirement. See 45 CFR § 164.530(b) and HHS guidance on HIPAA compliance certification.

How to apply minimum necessary access during inpatient consultations

Use only the records and information needed for your assigned role and the patient’s care. Accessing a chart out of curiosity, looking up acquaintances, or sharing information with staff who are not involved in an authorized purpose can violate policy, even when you work in the same hospital.

HIPAA requires reasonable limits on many uses, requests, and disclosures of PHI. For internal access, organizations should define appropriate access by job responsibilities. However, HIPAA’s minimum necessary standard does not apply to disclosures to—or requests by—health care providers for treatment purposes. That exception does not make access for non-treatment purposes appropriate. Review HHS guidance on the minimum necessary requirement.

In practice, open the records relevant to your consultation, use approved workflows, and avoid browsing unrelated sections of the chart. Follow role-based EHR permissions and local policies, especially when a record may be subject to Part 2 or another applicable confidentiality rule.

When can staff share patient information with the care team

HIPAA generally allows a provider to consult with other providers involved in a patient’s treatment without obtaining a separate HIPAA authorization. Treatment includes consultation between providers and coordination or management of care. Information shared should serve a legitimate care purpose and go to an appropriate member of the care team.

Part 2 may add a consent requirement when the information comes from a Part 2 program or is otherwise a Part 2 record. Under the current rule, a patient may give a single consent covering future disclosures for treatment, payment, and health care operations. If a HIPAA-covered provider receives a Part 2 record with this consent, the provider may generally redisclose it as HIPAA allows, with continuing restrictions on use in legal proceedings against the patient. See HHS’s Part 2 overview.

Before sharing information, confirm the recipient’s role and the purpose of the request, check any consent or restriction recorded in the chart, and use the hospital’s approved process for Part 2 information. If the patient objects or the record’s status is uncertain, pause and ask the privacy officer rather than assuming that the usual treatment exception resolves every rule.

How to handle patient consent and authorization for disclosures

Do not treat HIPAA consent, HIPAA authorization, and Part 2 consent as interchangeable. HIPAA generally does not require written authorization for treatment, payment, or health care operations, though an organization may use its own consent process. HIPAA authorization is generally needed for uses or disclosures not otherwise permitted by the Privacy Rule.

For Part 2 records, follow the Part 2 consent and exception rules that apply to the specific record and disclosure. A valid Part 2 consent may authorize future treatment, payment, and health care operations disclosures; it does not eliminate all Part 2 protections. Separate handling rules apply to SUD counseling notes maintained separately from the rest of the record, which are not covered by a broad TPO consent. See the HHS fact sheet on the Part 2 final rule.

For a request from family, an employer, law enforcement, or another outside party, do not rely on a patient’s informal verbal permission unless your policy and the applicable rules allow it. Route requests through the designated process, verify any authorization or Part 2 consent, and refer subpoenas, court orders, or unclear requests to privacy or legal staff.

What safeguards protect addiction records in the EHR and at the bedside

Use your own credentials, lock the workstation when stepping away, and access records only through approved systems. Do not share passwords, leave printed charts in public areas, or send patient details through personal email or unapproved messaging tools. Report misplaced devices or suspicious account activity promptly.

At the bedside, use a private setting when possible, speak discreetly, confirm who is present, and check whether the patient wants others included in the conversation. Secure paper notes and handoffs, and avoid discussing identifiable information where visitors or other patients may overhear. These practical steps support the administrative, physical, and technical safeguards required by the HIPAA Security Rule.

Hospitals must use appropriate safeguards for electronic PHI, including controls for authorized access and review of system activity. Follow your organization’s procedures for EHR permissions, audit alerts, secure communication, and storage or disposal of records; consult the security team if a workflow seems to expose information unnecessarily.

How to respond to privacy incidents and suspected breaches

Report a suspected privacy or security incident immediately through your hospital’s designated channel, such as the privacy office, security team, supervisor, or incident-reporting system. Examples include a misdirected message, a lost device, an unusual EHR access, or an overheard disclosure. Do not wait to determine whether the incident legally qualifies as a breach.

If safe and appropriate, take steps to contain the issue—for example, retrieve a misdirected printout or notify the recipient not to use or share an email sent in error. Preserve relevant details, including the time, systems, information involved, and people notified. Do not delete evidence, conduct an independent investigation, or notify patients on your own; the organization will assess the incident and decide what actions and notifications are required.

The HIPAA Breach Notification Rule generally requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI. Part 2 programs also have breach-notification duties for unsecured Part 2 records. The organization, not an individual staff member acting alone, determines whether notification is required and handles required reports. See HHS’s HIPAA Breach Notification Rule guidance and HHS breach-reporting guidance for HIPAA and Part 2.

Summary: Protect addiction treatment information by following role-based access and bedside safeguards, distinguishing HIPAA permissions from Part 2 requirements, checking consent and authorization before disclosures when required, and promptly reporting suspected incidents under your hospital’s procedures.

FAQs

Does HIPAA apply to inpatient addiction consult services?

HIPAA applies when the hospital or other organization is a covered entity or business associate, and it governs the PHI handled by its workforce. Additional protections under 42 CFR Part 2 may apply to records from a federally assisted SUD program. An SUD diagnosis in a general inpatient chart does not by itself establish that every record is subject to Part 2.

When does 42 CFR Part 2 apply to addiction treatment records?

Part 2 applies to records of federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment, and some requirements also apply to people or organizations that receive Part 2 records. Determine the record’s source and applicable consent or exception rather than assuming all addiction-related documentation has the same status. See HHS’s overview of Part 2.

Can consult staff share patient information with the inpatient care team without authorization?

HIPAA generally permits provider-to-provider disclosures for treatment without a separate HIPAA authorization. If the information is subject to Part 2, the applicable Part 2 consent or exception must also be satisfied. Check the record, the purpose, and hospital policy; ask the privacy officer when any of these are uncertain.

What should staff do after a suspected privacy breach?

Report it immediately through the hospital’s privacy or security process, preserve relevant details, and take reasonable steps to contain further exposure if directed or safe to do so. Do not make your own legal determination or contact patients on the organization’s behalf; the privacy team will assess the incident and manage any required notifications.