Medical Records and the Law

128 CHAPTER 6: ACCESS TO HEALTH INFORMATIONincluding hospitals, MCOs, long term care facilities, home healthagencies, substance abuse agencies, and hospices. 103Federal Substance Abuse Confidentiality RequirementsThe Drug Abuse Prevention, Treatment, and Rehabilitation Act of1972 and related amendments and the Comprehensive Alcohol Abuseand Alcoholism Prevention, Treatment, and Rehabilitation Act of1970 and amendments, 104 all amending the Public Health Service Act,and the related federal regulations 105 establish a comprehensive regulatoryscheme for the protection of substance abuse patient health information.(See the discussion of substance abuse records later in thischapter.) The federal substance abuse confidentiality law applies tomost alcohol and drug abuse treatment, and prohibits the disclosure ofinformation concerning such treatment except as specifically authorized.Although providers of substance abuse treatment will likely besubject to both the federal substance abuse confidentiality regulationsand the HIPAA Privacy Rule, conflicts between the rules will not existin most cases. The Privacy Rule permits, but does not require, PHI tobe disclosed in certain circumstances that are not permitted under thePublic Health Service Act. Because the Privacy Rule provisions arepermissive, it is possible for a covered entity subject to the PublicHealth Service Act to comply with the act’s more restrictive protectionsfor substance abuse treatment information and not permit disclosureof the information. A provider subject to the Privacy Rule,therefore, would not violate its provisions by not disclosing the information.Thereverse is also true.The disclosures that the Public HealthService Act permits but does not require can be made without violatingeither that act or the Privacy Rule. Finally, a healthcare provider shouldbe able to provide the notices that must be given to the patient underthe Public Health Service Act and the Privacy Rule without creating aconflict between these two regulatory schemes.Other Federal Confidentiality LawsIn promulgating the HIPAA Privacy and Security Rules, DHHS tookthe position that covered entities could comply with the rules and with103See, e.g.,Conditions of Participation for Hospitals, 42 C.F.R. § 482.24(b)(3).104 42 U.S.C. §§ 4541 et seq.; 21 U.S.C. § 1101.10542 C.F.R. §§ 2.1 through 2.67.