42 CFR Part 2 Consent Requirements (Supersedes HIPAA)

 

• Applies to drug abuse treatment centers due to DEA use by the physician

• Consent must be given for most data sharing under 42 CFR part 2

• Exceptions to consent requirement:  medical emergency (disclosure to emergency personnel), law enforcement if there is an immediate threat to the health or safety of an individual due to a crime on the premises or against program personnel, immediate threats to health or safety that are not an emergency as long as patient-identifying information is not used, reports of child abuse and neglect- disclosure to state and local authorities is permitted without consent, court ordered disclosures-any person with an interest in disclosure may petition the courts to require disclosure

• Consent may be revoked in part or in full at any time

• Consents are time limited or event limited

• Consents are for disclosure to a specific person (preferred) or to a program

• Consent purpose for disclosure must be specified

• Redisclosure (after initial disclosure, information is disclosed again) requires consent except in the following situations:  research (may redisclose back to the physician or program), audits and evaluations (back to the physician or program (not the patient) or pursuant to a court order to investigate/prosecute the program or to a government agency overseeing a Medicare/Medicaid audit, to a Qualified Service Organization (billing or internal audit or labs), court order redisclosure (different requirements for civil and criminal cases)