General Operations

Maintaining privacy and confidentiality in health care can be complex, with specific considerations when dealing with patients with OUD. While practices must comply with relevant privacy and confidentiality regulations, it is also important to share information across the care team to care coordination. It is usually possible to balance these apparently conflicting requirements if appropriate patient consent forms and processes are included as standard operating procedures.

Two key federal privacy regulations (see below) direct privacy practices for treatment of SUD. Some states have additional regulations that practices must abide.

• Health Insurance Portability and Accountability Act (HIPAA): HIPAA standards provide privacy rights and protections for patient health information and govern how this information should be used and shared between providers.¹ See Resources for more information on how to comply with the HIPAA privacy rules.

• Confidentiality of Substance Use Disorder Patient Records, Title 42 of the Code of Federal Regulations (CFR) Part 2: These regulations restrict the disclosure and use of patient records that include information on SUD diagnoses and treatment.²

  Determine whether 42 CFR Part 2 applies to your practice. The rule applies only to entities that present themselves as providing SUD care. Since primary care practices are not usually identified this way, the rule likely does not apply.

  In 2024, the 42 CFR Part 2 regulations changed to align more with HIPAA, to be more flexible, to give patients control over their SUD treatment records, and to reduce the burden on providers. Now, a single consent can cover a patients Part 2 records, including treatment, payment, and healthcare operations (TPO). The hope is these added protections of patient confidentiality will reassure patients who may avoid SUD treatment for fear of discrimination and prosecution.³ For example:

  • Separate patient consent is required to share notes from SUD counseling.
  • Patient consent for disclosure and use of medical records does not transfer to consent for any criminal, civil, legislative, or administrative uses.

  SAMHSA has provided more information here: Fact Sheet 42 CFR Part 2 Final Rule | HHS.gov

• Release of Information: Information sharing can be key to care coordination both within a practice or organization and with external providers. 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records, aims to provide enhanced privacy protections to patients with OUD.

Telehealth is an effective, efficient, and feasible option for delivering behavioral health care, with clinical outcomes comparable to in-person treatment.^4,5 Its implementation has helped address a key challenge of the opioid crisis by expanding access to care in areas with few behavioral healthcare providers.^4-7 Consider which patients you are comfortable seeing for refills via telehealth, and whether the practice would require an in-person visit with any degree of frequency.

The main methods of providing telehealth for OUD treatment are:

• Live videoconferencing;
• Live audioconferencing;
• Patient portals where patients can message their provider and view test results and other medical information;
• Store-and-forward video and digital images;
• Remote patient monitoring; and
• Web-based and mobile applications.⁸

In addition, digital therapeutics that provide evidence-based psychotherapies such as cognitive behavioral therapy or contingency management, online peer support and networking services, websites, mobile apps and short messaging service (SMS) texting programs, appear to be used and accepted by people in recovery.^22,23Some of these apps also include patient reported outcome measures (PROMs) that can help the patient and the therapist monitor progress and identify periods of increased risk of recurrence of use. The PROM data can be shared with the treatment team with patient consent. These applications can be used to treat, monitor, and/or manage OUD.^9-11

Best Practices for Telehealth Privacy and Security: The American Health Information Management Association (AHIMA) offers the following best practices for telehealth privacy and security:¹²

• Patients Telehealth Privacy. Be aware of patients location prior to initiating the telehealth visit and be mindful of the patients privacy and their needs.
• Secured Information Online. Use appropriate measures to protect patient information when sharing information online.
• Privacy and Security Standards. Incorporate telehealth services into privacy and security policies, procedures, and workflows; integrate telemedicine into the Notice of Privacy Practices.
• Reimbursement for Telehealth Services. Review insurers coverage determinations for telehealth services before scheduling visits and confirm that billing codes meet payor requirements.

Ongoing Issues: Although telehealth is now more widely accepted by insurance plans, it is essential to understand applicable state and federal regulations, as well as standards set forth by health care professional boards. Ongoing challenges include:

• Logistical Issues: Many patients do not have a consistent phone or internet connection for telehealth appointments.
• Legal and Regulatory Issues:
  • Prescribing remotely. Through December 31, 2025, providers can prescribe buprenorphine to new and existing patients with OUD via telephone.¹³ Efforts to make this flexibility permanent are ongoing.
  • Practicing across state lines. Expanding access to medications for OUD depends, in part, on providers being able to practice in multiple states. The Interstate Medical Licensure Compact facilitates this by expediting physician licensure across states. As of now, 40 states, the District of Columbia, and Guam have joined, with other states drafting legislation to participate.¹³
  • Privacy. Patient health information exchanged via telehealth must comply with HIPAA and other relevant laws to protect patient confidentiality. Some organizations must also follow the Federal Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR Part 2).² In 2024, a new rule aligned these regulations more closely with HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act, as required by the Coronavirus Aid, Relief, and Economic Security (CARES) Act.³
• Reimbursement: Telehealth requirements and reimbursement rates vary by state and payer. Information on state-level policies is available through Telehealth Policy Finder - CCHP, including details on Medicaid, Medicare and private insurance parity.

Practices and organizations providing medications for OUD must comply with all applicable federal and state laws and regulations related to ordering, storage, administration, and dispensing of these medications. It is essential to maintain accurate and up-to-date records that document compliance with these requirements.

• Note: The regulatory information in the Playbook is not intended to be comprehensive and may change after publication. Ensure compliance with all relevant laws and consult with legal counsel as needed.

Professional Licensure and Certification: Practices offering office-based treatment for OUD may be subject to additional regulations by state medical boards.

States may have additional laws or licensing requirements that restrict the ability of physician assistants and nurse practitioners to prescribe medications for OUD. For example, some states may impose limitations on nonphysician prescribers related to the age of patients eligible to receive these medications, the allowable duration of prescriptions, required supervisory arrangements, or the types of clinical settings in which prescribing is permitted.¹⁴

Code of Federal Regulations: The Diversion Control Division of the Drug Enforcement Agency (DEA) recommends providers who are authorized to prescribe, administer, and dispense approved Schedule III-V controlled substances to treat OUD, refer to the following sections of the Code of Federal Regulations:¹⁵

• 21 CFR 1304.03(c), 1304.03(d), and 1304.22(c) — Persons required to keep records and file reports;
• 21 CFR 1301.28(d)(3) — Exemption from separate registration for practitioners dispensing or prescribing Schedule III, IV, or V narcotic-controlled drugs approved by the Food and Drug Administration specifically for use in maintenance or detoxification treatment;
• 21 CFR 1306.05(a) and 1306.05(b) Manner of issuance of prescriptions;
• 21 CFR 1304.04 and 1304.11 Maintenance of records, reports, and inventories;
• 21 CFR 1301.71, 1301.75(b)and 1301.76 Security requirements; and
• 21 CFR 1307.21 Disposal of controlled substances.

DEA Inspections: The DEA is responsible for ensuring that prescribing providers comply with regulations under the Controlled Substances Act, including those related to recordkeeping and security. The DEA may conduct routine, unannounced inspections to verify compliance.¹⁶

Practices Dispensing Medications to Treat Opioid Use Disorder: The DEA also will conduct an audit to determine accountability of the controlled substance received and dispensed.¹⁷ This audit is considered one component of a larger DEA inspection process. Records should include the number of units and doses dispensed (with names and addresses of patients), dates medications were dispensed, and names of staff responsible for dispensing or administering the medications.

Develop and implement intake policies and protocols that establish a clear, consistent process for treating patients with OUD while ensuring compliance with all applicable regulations related to the dispensing and administration of medications to treat OUD. Once the intake forms and procedures have been completed, you can focus on developing the Person-Centered Care Plan.

The protocols are important whether the patient is new to your practice, or an existing patient newly initiating treatment. Patients may begin MOUD in your practice or be transferred to you for ongoing maintenance treatment after beginning MOUD elsewhere.

Informed Consent: Before beginning medication, ensure that patients provide informed consent. Consent documentation should include the standard elements of informed consent used in other medical contexts. Clearly outline the purpose of the medication, how it should be taken, potential risks and side effects, available alternatives, and what the patient can expect during different treatment phases.

Understand Insurance Requirements: They may have a large effect on treatment options and the treatment protocol. For example, determine whether the patients insurance plan imposes any of the following requirements for buprenorphine treatment:

• Pre-authorization;
• Use of specific forms or brands of the medication (i.e., formulary restrictions);
• Periodic drug testing; and
• Other plan-specific requirements.

Establish clear policies and protocols related to toxicology screening. These protocols may outline expectations around the frequency of testing and the methods used (e.g., urine versus saliva, point of care versus laboratory testing). Drug screens can help identify ongoing substance use that patients may not disclose due to fear or shame. The purpose of testing is to assess progress towards treatment goals—not to punish or terminate care.

Toxicology results can be a valuable clinical tool. They can help detect a return to illicit opioid use, monitor ongoing substance use, and flag medication nonadherence that may increase overdose risk.²⁵ Use these results to inform and adjust treatment plans as needed, such as by¹:

• Switching medications or formulations;
• Modifying dosing schedules or amounts;
• Implementing observed dosing;
• Encouraging increased engagement in counseling and recovery support services; and
• Referring to higher levels of care.

There is no national consensus on how often to conduct drug testing for office-based MOUD treatment. State Medicaid agencies may have specific requirements for testing frequency. When starting buprenorphine treatment, ASAM recommends random, unannounced testing (if possible) at least weekly. Afterward, the frequency can be reduced to monthly as recovery progresses. ASAM See the ASAM report Appropriate Use of Drug Testing in Clinical Addiction Medicine for additional guidance.