For much of healthcare, HIPAA sets the standards for how to manage uses and disclosures of patient information, known as Protected Health Information (PHI).
But when it comes to information related to the treatment of substance use disorders, regulations of the Substance Abuse and Mental Health Services Administration (SAMHSA) under 42 CFR Part 2 prevail, including rigorous controls on the release and re-release of patient information.
Why you should Attend:
While HIPAA rules apply to all Protected Health Information, the rules under 42 CFR Part 2 place special limitations on substance use disorder-related information. HIPAA has controls on the release of health information, but once it's released under HIPAA, the information is allowed to be used according to the regulations and obligations of the receiving party.
With information under Part 2, the obligations to protect the information travel with the information, placing recipients under obligations to provide further protection under Part 2 rules.
For decades, the rules under 42 CFR Part 2 have required that each and every release of information have a consent in place, but new rules allow release to "others involved in my care," including re-release of information without a new consent.
While this new option promises to simplify the release and re-release of information, implementation requires that it be possible to report to the individual a list of parties to whom the information has been released. The accounting for these disclosures is similar to the HIPAA accounting of disclosures in principle, but applies to treatment disclosures all the way down the chain of releases.
HIPAA allows a number of disclosures, for treatment, payment, and healthcare operations purposes, without consent from the individual being treated.
SAMHSA rules, on the other hand, require consent for every disclosure or re-disclosure, and if the proper consents aren't obtained, the provider can be in violation of the rules and subject to penalties.
Areas Covered in the Session:
- What HIPAA allows, what SAMHSA requires, and the differences will be explained
- We will Examine how to Determine if the services you provide place you under 42 CFR Part 2
- We will explore the means for making sure substance abuse Treatment Information Receives the Appropriate Protections
- The Consent and Release Requirements under HIPAA will be explained
- The consent and Release Requirements under 42 CFR Part 2 will be explained
- Re-release of Information released under 42 CFR Part 2 will be discussed
- Sharing of Information with Family and Friends in an overdose Incident will be explored
- Requirements for Providing an accounting of disclosures of Part 2 Information will be Explained
- Challenges in Managing mixed records with Some Part 2 and some non-Part 2 Data will be Discussed
Who Will Benefit:
- Compliance Director
- Privacy Officer
- Security Officer
- Information Systems Manager
- HIPAA Officer
- Chief Information Officer
- Health Information Manager
- Healthcare Counsel/Lawyer
- Office Manager
Speaker ProfileJim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to health care firms and businesses throughout the Northeast and nationally. Sheldon-Dean’s firm provides a variety of advisory, training, assessment, policy development, project management and mitigation services for a number of health care providers, businesses, universities, small and large hospitals, urban and rural mental health and social service agencies, health insurance plans and health care business associates. He serves on the HIMSS Information Systems Security Workgroup, the Workgroup for Electronic Data Interchange Privacy and Security Workgroup, and co-chairs the WEDI HIPAA Updates sub-workgroup. He is a frequent speaker regarding HIPAA and information privacy and security compliance issues at seminars and conferences, including speaking engagements at AHIMA national conventions and WEDI national conferences, and before the New York Metropolitan Chapter of the Healthcare Financial Management Association, Health Information Management Associations of New York City, New York State, and Vermont, the Connecticut Hospital Association, and the Hospital and Health System Association of Pennsylvania. Sheldon-Dean has nearly 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development. His experience includes leading the development of health care related Web sites; award-winning, best-selling commercial utility software; and mission-critical, fault-tolerant communications satellite control systems. In addition, he has eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master’s degree from the Massachusetts Institute of Technology.