HIPAA, Consents, and 42 CFR Part 2 - Tracking the Release of Information Under Conflicting Rules

MentorHealth
Duration: 90 Minutes
Instructor: Jim Sheldon Dean
Webinar Id: 801716

Recorded

$179.
One Attendee
$379.
Unlimited Attendees ?

In this webinar, we will examine how to determine if the services you provide place you under 42 CFR Part 2. We will explore the means for making sure that substance abuse treatment information receives the appropriate protections.

Overview:

For much of healthcare, HIPAA sets the standards for how to manage uses and disclosures of patient information, known as Protected Health Information (PHI).

But when it comes to information related to the treatment of substance use disorders, regulations of the Substance Abuse and Mental Health Services Administration (SAMHSA) under 42 CFR Part 2 prevail, including rigorous controls on the release and re-release of patient information.

Why should you Attend: While HIPAA rules apply to all Protected Health Information, the rules under 42 CFR Part 2 place special limitations on substance use disorder-related information. HIPAA has controls on the release of health information, but once it's released under HIPAA, the information is allowed to be used according to the regulations and obligations of the receiving party.

With information under Part 2, the obligations to protect the information travel with the information, placing recipients under obligations to provide further protection under Part 2 rules.

For decades, the rules under 42 CFR Part 2 have required that each and every release of information have a consent in place, but new rules allow release to "others involved in my care," including re-release of information without a new consent.

While this new option promises to simplify the release and re-release of information, implementation requires that it be possible to report to the individual a list of parties to whom the information has been released. The accounting for these disclosures is similar to the HIPAA accounting of disclosures in principle, but applies to treatment disclosures all the way down the chain of releases.

HIPAA allows a number of disclosures, for treatment, payment, and healthcare operations purposes, without consent from the individual being treated.

SAMHSA rules, on the other hand, require consent for every disclosure or re-disclosure, and if the proper consents aren't obtained, the provider can be in violation of the rules and subject to penalties.

Areas Covered in the Session:

  • What HIPAA allows, what SAMHSA requires, and the differences will be explained
  • We will Examine how to Determine if the services you provide place you under 42 CFR Part 2
  • We will explore the means for making sure substance abuse Treatment Information Receives the Appropriate Protections
  • The Consent and Release Requirements under HIPAA will be explained
  • The consent and Release Requirements under 42 CFR Part 2 will be explained
  • Re-release of Information released under 42 CFR Part 2 will be discussed
  • Sharing of Information with Family and Friends in an overdose Incident will be explored
  • Requirements for Providing an accounting of disclosures of Part 2 Information will be Explained
  • Challenges in Managing mixed records with Some Part 2 and some non-Part 2 Data will be Discussed

Who Will Benefit:
  • Compliance Director
  • CEO
  • CFO
  • Privacy Officer
  • Security Officer
  • Information Systems Manager
  • HIPAA Officer
  • Chief Information Officer
  • Health Information Manager
  • Healthcare Counsel/Lawyer
  • Office Manager

Speaker Profile
Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a wide variety of health care entities.

Sheldon-Dean serves on the HIMSS Information Systems Security Workgroup, has co-chaired the Workgroup for Electronic Data Interchange Privacy and Security Workgroup, and is a recipient of the WEDI 2011 Award of Merit. He is a frequent speaker regarding HIPAA and information privacy and security compliance issues at seminars and conferences, including speaking engagements at numerous regional and national healthcare association conferences and conventions and the annual NIST/OCR HIPAA Security Conference in Washington, D.C.

Sheldon-Dean has more than 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development. His experience includes leading the development of health care related Web sites; award-winning, best-selling commercial utility software; and mission-critical, fault-tolerant communications satellite control systems. In addition, he has eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master's degree from the Massachusetts Institute of Technology.


You Recently Viewed