What is a part 2 provider in HIPAA?

A Part 2 program is defined under 42 CFR Part 2 as any federally assisted program (whether general or specialized) that holds itself out as providing, and provides, substance use disorder (SUD) diagnosis, treatment, or referral for treatment.

Key Criteria of a Part 2 Program

• Federally Assisted: The entity receives federal funding, holds tax-exempt status, is registered with the IRS/federal government, or is authorized/licensed by the federal government (such as Medicare/Medicaid enrollment or a DEA registration for prescribing medications like methadone).
• Holding Out and Providing SUD Services: The provider explicitly identifies as a substance use disorder provider or has a specialized unit/staff whose primary function is providing SUD diagnosis, treatment, or referral.
• Stricter Privacy Protections: Unlike standard medical records under HIPAA, Part 2 program records require explicit, written patient consent for disclosure, with narrow exceptions like medical emergencies or specific court orders.

The 5 basic rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, the Security Rule, the Breach Notification Rule, the Enforcement Rule, and the Omnibus Rule.

The 5 Core HIPAA Rules

• Privacy Rule: Protects the confidentiality of medical records and individually identifiable health information (PHI), giving patients rights over their data.
• Security Rule: Sets technical, physical, and administrative standards to secure electronic protected health information (ePHI).
• Breach Notification Rule: Requires healthcare groups to notify patients, the government, and sometimes the media when a data breach compromises unsecured PHI.
• Enforcement Rule: Explains how investigations work and outlines the civil and criminal financial penalties for breaking HIPAA rules.
• Omnibus Rule: Expands privacy protections and applies HIPAA requirements directly to business associates (contractors and partners of healthcare providers).

You can read a detailed overview of the primary regulations through the U.S. Department of Health & Human Services Privacy Guide.

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

• Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
• Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
• Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
• Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
• Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
• Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
• Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
• Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
• Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
• Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

The three main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

1. The HIPAA Privacy Rule

The Privacy Rule sets national standards to protect individuals' medical records and other protected health information (PHI).

• Scope: Applies to paper, electronic, and spoken PHI.
• Patient Rights: Gives patients the right to view, obtain copies of, and request corrections to their health records.
• Use and Disclosure: Limits how organizations can share health data, enforcing the "minimum necessary" standard so staff only access data required for their specific jobs.

2. The HIPAA Security Rule

The Security Rule specifies the administrative, physical, and technical safeguards organizations must use to protect electronic protected health information (ePHI).

• Administrative Safeguards: Security policies, staff training, and periodic risk assessments.
• Physical Safeguards: Facility access controls, workstation security, and device protection.
• Technical Safeguards: Access controls, password protection, and end-to-end data encryption.

3. The HIPAA Breach Notification Rule

The Breach Notification Rule requires covered entities to notify affected individuals, the government, and sometimes the media when unsecured PHI is compromised.

• Individual Notice: Affected patients must be notified without unreasonable delay and within 60 days of discovering the breach.
• Government Notice: The Department of Health and Human Services (HHS) must be notified within 60 days (or immediately if 500 or more individuals are affected).
• Media Notice: Prominent local media outlets must be alerted if a breach affects more than 500 residents in a single state or jurisdiction.

42 CFR Part 2 is a federal regulation in the United States that protects the confidentiality of substance use disorder (SUD) treatment records.

Core Purpose

• Encourages Treatment: It gives patients assurance that their medical history regarding drug or alcohol use will remain private, removing the fear of job loss, housing discrimination, or legal prosecution.
• Strict Consent Rules: Unlike standard medical records under HIPAA, Part 2 generally requires specific patient consent before records can be disclosed—even for basic tasks like care coordination or billing.
• Applies to Federally Assisted Programs: It covers any program or facility that provides SUD diagnosis, treatment, or referral and receives any federal assistance (such as tax-exempt status or Medicare/Medicaid funding).

Key Protections and Rules

• Legal Proceedings: Records and testimony are heavily restricted and generally cannot be used in civil, criminal, or administrative proceedings against a patient without a specialized court order or explicit consent.
• Limited Exceptions: Disclosures without consent are only allowed in narrow situations, such as verified medical emergencies, specific internal audits/evaluations, or reporting crimes committed on the premises.
• HIPAA Alignment: Recent updates have aligned Part 2 more closely with HIPAA Rules. Patients now benefit from breach notification rights, and violations carry civil and criminal penalties similar to HIPAA enforcement.