Records from DMH inpatient and outpatient facilities or programs that are also Alcohol and Drug (A&D) “Programs”, are protected by additional and much more restrictive Federal Law (42 CFR Part 2.) 42 CFR Part 2 applies to any “federally assisted” A&D “Program.”

DMH inpatient and outpatient facilities and programs are “federally assisted”. 42 CFR Part 2 defines an A&D “Program” as an entity (e.g. DMH inpatient or outpatient facility or program) that “holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment.

This definition of an A&D “Program” clearly applies to Morris Village and to Hall Adolescent Recovery Program (ARP) Unit 170. A “Program” subject to 42 CFR Part 2 also includes many DMH Community Mental Health Center (CMHC) Co-Occurring Disorder (COD) programs. If a CMHC COD program “holds itself out” (represents itself to the community or others by published services, provider listing, brochures, website, etc.) that it provides A&D treatment, diagnosis, OR referral for A&D treatment, then it is a “Program” and ALL “Program” records are covered by 42 CFR Part 2.

42 CFR Part 2 is much more restrictive than HIPAA and other law protecting DMH patient or client confidentiality. In comparison with those other privacy laws, 42 CFR Part 2 severely restricts the use and disclosure of A&D “Program” Protective Health Information (PHI), especially disclosures of “Program” PHI outside of DMH, and applies to both clinical and financial (billing and payment) PHI.

42 CFR Part 2 Does NOT Allow Many Disclosures Permitted By HIPAA/Other Law:

  1. NOT: As needed to coordinate treatment or care (e.g. to other medical/care providers, hospitals, CRCFs, RTFs, DSS, DJJ, DDSN, DVR, DOC/jail medical staff, family caregivers, etc.)
  2. NOT: Pursuant to another agency or law enforcement subpoena or investigative or prosecutorial demand, or for other law enforcement or agency investigation or activity
  3. NOT: When otherwise allowed or required by other law (including many other Federal laws)
  4. NOT: For most routine or general court orders and judicial procedures and processes

In most instances, for DMH PHI disclosures outside DMH, “Program” record/PHI disclosure is permitted ONLY by specific written authorization or court order. The written authorization must be very specific and detailed as signed by the patient/client (e.g. DMH Authorization Forms: M-450D and M-450I.) The court order (and special judicial procedure) varies by type of court and also must be very specific and detailed.

Without Specific Detailed Authorization or Court Order, Disclosure Is Limited To:

  1. Info that does NOT identify patient/client (name, address, DOB, or SS, Record ID or phone #, etc.)
  2. Internal DMH communication, but ONLY when clear need to know in order to perform DMH job
  3. Medical emergencies, but ONLY to medical personnel treating the emergency (e.g. ED staff)
  4. Initial reports of abuse and neglect (but NOT for follow up investigation)
  5. Limited approved research or audit by very specific written agreement and conditions
  6. Initial reports of crimes or threats of crime on “Program” premises or against “Program” personnel
  7. Pursuant to an approved DMH Business Associate/Qualified Service Organization Agreement