General Operations

Maintaining privacy and confidentiality in health care can be complex and confusing, sometimes even more so when dealing with substance use disorders. This section briefly highlights the two major relevant Federal privacy regulations and provides links to a deeper discussion of the issues. However, some States have additional more extensive regulations that practices must be aware of and comply with.

While practices must comply with all relevant privacy and confidentiality regulations, it is also important to share information across the care team to facilitate care coordination and improve patient outcomes. It is nearly always possible to balance these apparently conflicting requirements if appropriate patient consent forms and processes are included as standard operating procedures.

Health Insurance Portability and Accountability Act (HIPAA). HIPAA standards provide privacy rights and protections for patient health information and govern how this information should be used and shared between providers. For more information, refer to guidance on how to comply with the HIPAA privacy rules, The Confidentiality of Alcohol and Drug Abuse Patient Records Regulation and the HIPAA Privacy Rule: Implications for Alcohol and Substance Abuse Programs (PDF—380 KB).

Confidentiality of Alcohol and Drug Abuse Patient Records, Title 42 of the Code of Federal Regulations (CFR) Part 2. These regulations establish restrictions on the disclosure and use of patient records that include information on substance use disorder diagnoses and treatment. Practices and providers often are unsure whether they are subject to 42 CFR Part 2 and are concerned they will violate these rules. This concern may unnecessarily impede information sharing and care coordination. Refer to frequently asked questions (PDF—380 KB) for more information about these confidentiality regulations.

The U.S. Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology and the Substance Abuse and Mental Health Services Administration (SAMHSA) developed two fact sheets to help practices understand how to apply Part 2 across settings:

• Disclosure of Substance Use Disorder Patient Records: Does Part 2 Apply to Me? (PDF—1.42 MB)
• Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? (PDF—1.62 MB)

42 CFR Part 2 has been recently amended in an attempt to clarify the regulations and reduce the burden on providers. SAMHSA has sought to educate the public on the proposed revisions and final rule. It remains to be seen how the amended regulations will be interpreted and affect information exchange and care coordination.

Release of Information. Information sharing can be key to care coordination both within a practice or organization and with external providers. 42 CFR Part 2, Confidentiality of Alcohol and Drug Abuse Patient Records, aims to provide enhanced privacy protections to patients with substance use disorders. Releases of information for MAT patients will require specific elements to meet these regulations, including:

• Patient name.
• Name/general designation of program making disclosure.
• Recipient information (can list multiple parties and have form authorize disclosures to all parties listed).
• Narrow purpose of disclosure.
• Information to be released.
• Acknowledgment that patient can revoke consent at any time.
• Expiration date or condition of consent.
• Date of signature.
• Patient signature.

Copies of these releases should be signed and stored appropriately.

Telehealth can be a useful resource for practices, particularly those in rural areas, because it can connect providers and patients to resources or services unavailable in their local area. MAT services for which providers may be able to use telehealth platforms include behavioral health services and medication management. The main methods of telehealth are:

• Live video,
• Store-and-forward video and digital images,
• Remote patient monitoring, and
• Web-based and mobile applications.¹

While telehealth is a promising and rapidly changing field, implementation of telehealth services for patient care and provider support still faces some challenges, particularly around billing and cost recovery.

There are also potential limitations on the types of services that can be delivered via telehealth depending on applicable laws and regulations. At the Federal level, the prescription of buprenorphine is regulated by the Controlled Substances Act, which requires an in-person medical evaluation before the medication is prescribed.² The Ryan Haight Online Pharmacy Consumer Protection Act does allow an exception to the in-person exam requirement if telemedicine is used. To qualify for this exception, the situation must meet certain criteria (PDF—620 KB).

Prescribing of medications may also be subject to additional restrictions set by States on internet prescribing. However, in the face of the opioid epidemic, some States are relaxing requirements for the prescription of medications to treat opioid use disorder through telehealth.³

If a provider and a patient are located in two different jurisdictions, this situation may create complications for regulatory compliance. Many States require clinicians providing telemedicine to be licensed in the State in which the patient is located.¹ However, licensure compacts among States are becoming more common to facilitate telehealth services.³

When considering how to use telehealth services in a practice, it is important to carefully examine State and Federal regulations as well as any standards set forth by health care professional boards to understand what is allowed. Learn more about current State laws and reimbursement policies for telehealth services.

Practices and organizations offering MAT services must follow all Federal and State laws and regulations related to ordering, storage, administration, and dispensing of medications to treat opioid use disorder. Proper records should be maintained that reflect the program’s compliance with these laws.

The information provided in this Playbook regarding regulations is not intended to be a comprehensive discussion and these may change after publication. Practices should do their own due diligence to ensure compliance with all Federal, State, and local laws and consult with legal counsel when necessary.

Professional Licensure and Certification. Practices offering office-based treatment for opioid use disorders may be subject to additional regulations by State medical boards. These may vary by State, although the Federation of State Medical Boards developed a Model Policy on DATA 2000 and Treatment of Opioid Addiction in the Medical Office (PDF—230 KB).

Physicians, nurse practitioners, and physician assistants who have received their Drug Addiction Treatment Act of 2000 (DATA 2000) waivers to prescribe buprenorphine should ensure ongoing compliance with all requirements associated with those waivers, including adhering to patient limits. Learn more about buprenorphine waiver management.

States may have additional laws or licensing requirements that restrict physicians assistants and nurse practitioners’ ability to prescribe medications to treat opioid use disorder. For example, they may impose limits on nonphysician prescribers, such as the ages of patients to whom these medications may be prescribed, duration of the prescriptions, supervisory requirements, and settings in which they may be prescribed.⁴

Code of Federal Regulations. The Diversion Control Division of the Drug Enforcement Agency (DEA) recommends providers who are authorized to prescribe, administer, and dispense approved schedule III-V controlled substances to treat opioid use disorder refer to the following sections of the Code of Federal Regulations⁵:

• Individuals required to keep records and file reports—21 CFR 1301.28(d)(3), 1304.03(c), 1304.03(d), 1304.22(c), and 1306.05(a)
• Maintenance of records, reports, and inventories—21 CFR 1304.04 and 1304.11
• Security—21 CFR 1301.71, 1301.75(b), and 1301.76
• Thefts involving controlled substance—21 CFR 1301.76(b)
• Disposal of controlled substances—21 CFR 1307.21

DEA Inspections. The DEA is responsible for ensuring prescribing providers are in compliance with regulations related to recordkeeping, security, and other requirements under the Controlled Substances Act. The DEA will hold routine, unannounced inspections to ensure providers are following all regulations related to recordkeeping and security. During an inspection, the DEA will look at records for patients being prescribed buprenorphine.⁶ Logs for DEA inspections should include patient names or identification numbers, dates of prescriptions, and details of the medication prescribed.⁶

Programs Dispensing Medications to Treat Opioid Use Disorder. The DEA also will conduct an audit to determine accountability of the controlled substance received and dispensed.⁶ This audit is considered one component of a larger DEA inspection process. Records should include the number of units and doses dispensed (with names and addresses of patients), dates medications were dispensed, and names of staff responsible for dispensing or administering the medications.⁷

Learn about record-related requirements and How To Prepare for a Visit From the DEA Regarding Buprenorphine Prescribing (PDF—390 KB). Providers Clinical Support System has also collected links to regulations to which DEA agents refer (PDF—103 KB) in the inspection process and a sample drug accountability record (PDF—150 KB) and buprenorphine prescription log (PDF—166 KB).