Ohio Opioid Treatment Program Take-Home Dose Logs: Privacy Laws Guide

What information must Ohio opioid treatment programs record for take-home doses

Ohio opioid treatment programs (OTPs) must maintain an individual client record that includes the date of each patient visit and, for medication administered or dispensed, the date, time, and amount, along with the service provider’s printed name and original signature. These OTP medication dispensing records can include take-home dose entries because take-home medication is dispensed to the patient. Ohio Administrative Code 5122-40-07

Records should also show the signed, dated prescriber order for medication. Ohio rules assign the medical director responsibility for ensuring that the justification for take-home doses is recorded in the patient’s clinical record. The OTP’s written procedures must address take-home decisions, and the prescriber must document an individualized rationale for authorizing them. Ohio Administrative Code 5122-40-05 and Ohio Administrative Code 5122-40-06

As a practical matter, a log should make it possible to connect each take-home authorization and dispensing event to the applicable patient, medication, quantity, date, prescriber order, and staff member. Record only information needed for treatment, dispensing, and required oversight; a take-home log is not a reason to collect unrelated details.

How do 42 CFR Part 2 and HIPAA protect take-home dose logs

A take-home dose log that identifies a person as receiving opioid use disorder treatment is generally a substance use disorder patient record protected by 42 CFR Part 2 when it is maintained by a federally assisted Part 2 program. Part 2 applies to identifying records connected to substance use disorder diagnosis, treatment, or referral; it restricts disclosures unless the patient consents or a specific regulatory exception applies. 42 CFR § 2.12

HIPAA also applies if the OTP is a covered entity or business associate. The HIPAA Privacy Rule governs permitted uses and disclosures of protected health information, while the HIPAA Security Rule requires appropriate safeguards for electronic protected health information. When both laws apply, the OTP must meet both; Part 2’s additional limits remain important, particularly for disclosure of records that identify a patient as receiving SUD treatment. HHS summary of the HIPAA Security Rule

Under current Part 2 rules, a patient may give a single written consent for future disclosures for treatment, payment, and health care operations. A covered entity or business associate that receives records under that consent may generally redisclose them as HIPAA permits, but Part 2 still restricts using or disclosing them in proceedings against the patient. Consent must meet Part 2 requirements; a general medical-record release is not automatically sufficient. 42 CFR § 2.31 and 42 CFR § 2.33

The 2024 Part 2 final rule has been effective since April 16, 2024, and compliance was required by February 16, 2026. OTPs should use the current requirements, rather than relying on older consent and disclosure procedures. HHS overview of 42 CFR Part 2

When may an OTP disclose take-home dose records without patient consent

Part 2 permits certain limited disclosures without patient consent. For example, necessary patient-identifying information may be disclosed to medical personnel to address a bona fide medical emergency when prior written consent cannot be obtained. The program must document the disclosure, including who received and made it, when it occurred, and the nature of the emergency. This is a limited emergency pathway, not general permission to give records to family members or other nonmedical recipients. 42 CFR § 2.51

Other specific provisions cover matters such as communications among personnel who need the information for their work within a Part 2 program, communications with a qualified service organization for services provided to the program, reports of suspected child abuse or neglect as required by state law, and certain crimes committed on program premises or against program personnel. The crime-on-premises exception is limited to information directly related to the incident; it does not authorize handing over a patient’s full take-home log. 42 CFR § 2.12

For an audit or evaluation, a permitted reviewer may examine records on the premises under specified conditions, including agreeing in writing to the applicable limits on use and redisclosure. The rules for an on-site review do not create a general right to copy or remove patient-identifying logs. 42 CFR § 2.53

A program may also disclose records when the patient provides valid written consent that covers the requested information and recipient. Ohio rules separately require OTPs to ask for patient consent for disclosure of OTP information to the state drug database, including asking again at specified intervals when consent was not given at admission. That limited state process is not blanket authorization for other disclosures. Ohio Administrative Code 5122-40-07

How do Ohio rules govern record access and retention

Part 2 does not prohibit an OTP from giving patients access to their own records, including an opportunity to inspect and copy records the program maintains about them. A patient can ask the OTP how to submit a request and what identity verification or format options are available. HIPAA-covered providers may also have obligations to provide individuals access to protected health information under the HIPAA Privacy Rule. 42 CFR § 2.23 and HHS guidance on accessing medical records

Ohio requires OTP patient records to be maintained for at least seven years from the last date the program administered or dispensed a controlled substance. Because the required dispensing information is part of the individual client record, take-home dose documentation should be retained with that record for the applicable period. Ohio Administrative Code 5122-40-07

Programs should apply their approved retention schedule consistently and check for any applicable legal hold or other record-specific requirement before destroying records. Any access to or use of a retained log must still follow applicable confidentiality rules.

What procedures protect take-home logs from unauthorized access

Ohio requires OTPs to assign responsibility for conformity with federal confidentiality regulations, including Part 2, and to maintain required policies and procedures. Part 2 also requires security procedures for records, including written safeguards for handling and securely disposing of patient-identifying information. Ohio Administrative Code 5122-40-05 and 42 CFR § 2.16

For electronic records, the HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards when it applies. HHS describes safeguards such as access controls, audit controls, authentication, and transmission security. Programs can use role-based permissions, unique user accounts, access reviews, secure storage, and audit-log review as practical controls to help meet their obligations. The specific measures should follow the program’s security risk analysis and applicable rules. HHS summary of the HIPAA Security Rule

For paper logs, restrict storage and retrieval to authorized staff, keep records out of public or shared areas, and use secure procedures for transport and disposal. Train staff to verify recipients and authority before sharing any record. If unsecured Part 2 records are breached, applicable breach-notification requirements may require notice to affected individuals and HHS. HHS Part 2 guidance

How should programs respond to subpoenas and law enforcement requests

Do not disclose a Part 2 take-home log merely because an attorney, court, or law enforcement agency requests it or serves a subpoena. Under Part 2, a subpoena alone does not authorize disclosure: the person holding the record generally may not produce it in response to a subpoena unless a court of competent jurisdiction has entered an authorizing Part 2 order. A subpoena or other compulsory process may also be needed to compel production after an order is entered. 42 CFR § 2.61

For a noncriminal proceeding, a Part 2 court order requires a finding of good cause, including that other ways of obtaining the information are unavailable or ineffective and that the need for disclosure outweighs potential injury to the patient and treatment services. The order must limit disclosure to the information and people essential to its purpose. 42 CFR § 2.64

For a criminal investigation or prosecution of a patient, the federal standard is narrower: a court may authorize disclosure only if the criteria in Part 2 are met, including that the crime is extremely serious and the records have substantial value to the case. Any order must limit the information disclosed and its use. A program should refer subpoenas, warrants, and other legal demands to counsel or its designated privacy officer, preserve responsive records, verify the scope and validity of the process, and disclose only what applicable law authorizes. 42 CFR § 2.65

In short, Ohio OTPs must document dispensing and take-home decisions, retain the patient record for at least seven years after the last controlled-substance administration or dispensing, and protect identifying logs under applicable Part 2 and HIPAA requirements.

FAQs.

Are take-home dose logs protected by 42 CFR Part 2?

Yes, when the log identifies a patient as receiving substance use disorder treatment and is maintained by a federally assisted Part 2 program. Disclosure generally requires valid patient consent or a specific regulatory exception, such as a qualifying medical emergency or an authorizing court order.

Can an Ohio OTP share take-home dose logs with family members?

Not merely because someone is a family member. The OTP generally needs valid Part 2 consent that permits the disclosure or another applicable exception. A HIPAA permission to involve family in care does not by itself override stricter Part 2 requirements.

Can law enforcement obtain take-home dose logs without patient consent?

Not through a routine request or subpoena alone. Part 2 generally requires an authorizing court order, and a subpoena or other compulsory process may also be necessary. A narrow exception may permit limited reporting about a crime on OTP premises or against program personnel, but it does not allow general access to a patient’s take-home records.

How long must an Ohio OTP retain take-home dose records?

Ohio requires the patient record to be retained for at least seven years from the last date a controlled substance was administered or dispensed. Take-home dispensing documentation maintained as part of that record should be retained for that period.