42 CFR Part 2 Data in a Regional Health Information Exchange
Riverbend Behavioral Health is a 12-clinician clinic with 800 active patients, including 260 receiving substance use disorder treatment. The clinic joins a regional HIE to improve care coordination. Its existing consent form authorizes release of information to the HIE and its participants for treatment, payment, and operations. The HIE model is a longitudinal record visible to all participating providers, including emergency departments and a payer-sponsored care management team. The clinic's privacy officer learns that 42 CFR Part 2 requires a more specific consent for SUD records and that the state requires explicit consent for HIV and mental health data. The HIE contract says the clinic is responsible for obtaining all consents and that the HIE may redisclose as permitted by law. The clinic has already uploaded 200 patients' records, including SUD notes. The board wants to avoid disrupting care but also avoid a complaint.
1. Can Riverbend rely on its existing consent to keep SUD records in the HIE? Explain what must change.
Read the worked answer
No. A generic treatment, payment, and operations consent is not sufficient for Part 2 records. Part 2 requires a written consent that identifies the recipient, the purpose, the amount and kind of information, the patient's right to revoke, and an expiration date or event. A longitudinal HIE visible to all participants and a payer care management team is broader than the existing form contemplates. The HIE may act as an intermediary, but the clinic must ensure the consent names the HIE and explains that participants can access the record. State law adds separate requirements for HIV and mental health data, so the clinic likely needs layered authorizations. The 200 already-uploaded records are a problem: either obtain valid consent or remove or segment the SUD data. The HIE must agree to enforce restrictions and prohibit redisclosure without proper consent. Do not rely on the HIE contract clause that shifts all responsibility to the clinic; the clinic remains accountable. Redesign the HIE data model to flag and segment Part 2 data, and update the consent workflow before further uploads.
2. How should the clinic respond to a subpoena from a law enforcement officer for one patient's SUD records?
Read the worked answer
A subpoena alone is not enough for Part 2 records. The clinic should not release the records until counsel confirms that a qualifying court order has been issued or the patient has given valid written consent. Part 2 court orders must meet specific findings, and law enforcement requests must be precise. Verify the patient identity, the scope of the request, and whether the order is from a court with jurisdiction. If the request is defective, respond in writing and preserve the records. The HIE must also have a flag that prevents automatic disclosure. If a valid order exists, disclose only the records covered, log the disclosure, and notify the patient when permitted. Train front-desk staff not to honor verbal or subpoena-only requests. This preserves cooperation with law enforcement while avoiding a criminal or civil Part 2 violation.