What Does C.F.R. Cover?
The Federal Drug and Alcohol Confidentiality Law (42 C.F.R. Part 2) and 42 C.F.R. Part 2 applies to “federally-assisted” providers that meet the definition of a “program.” A “program” includes any individual or entity that provides, in whole or in part, alcohol or drug abuse diagnosis, treatment, and referral for treatment or prevention. (42 USC §§ 290dd-2, 42 CFR 2.11)1
A program is “federally-assisted” if it:
(a) Receives federal funds in any form, whether or not the funds directly pay for alcohol or drug abuse services; or
(b) Is being carried out under a license, certification, registration, or other authorization granted by the federal government (e.g., licensed to provide methadone, certified as a Medicare provider); or
(c) Is assisted by the I.R.S. through a grant of tax-exempt status or allowance of tax deductions for contributions; or
(d) It is conducted directly by the federal government or by a state or local government that receives federal funds, which could be (but are not necessarily) spent for alcohol or drug abuse programs. 42 C.F.R. § 2.12(b)
School-based “programs” are specifically covered under 42 CFR Part 2. 42 CFR § 2.12(e)(1).
There has been some discussion about whether prevention programs are covered by 42 C.F.R. Part 2 because the original regulations themselves did not specifically mention prevention programs. However, the current federal authorizing statute for the regulations (47 U.S.C. § 290dd-2) and the original authorizing statutes (42 U.S. C §§ 290dd-2 and 290ee-3) are now incorporated into the regulations explicitly state that prevention programs and activities are covered. Covered transactions include:
- claims processing
- payment and remittances
- coordination of benefits
- checking claim status
- enrollment or dis-enrollment in a health plan
- health plan eligibility
- health plan premium payments
- referral
- certification and authorization
- first report of injury
- health claim attachments
Only “covered entities” that electronically transmit information to carry out these financial or administrative duties are covered by HIPAA. Therefore, drug and alcohol prevention programs are health care providers and, as such, are required to comply with HIPAA if they transmit covered transactions electronically. General education classes would not be covered by HIPAA as they would not meet the definition of “health care” under HIPAA.
What if both HIPAA and 42 C.F.R. Part 2 apply? If a program is covered under both HIPAA and 42 C.F.R. Part 2, the statute that is more protective of the patient’s identifying information must be followed.
Although the reach of HIPAA is more expansive, the vast majority of drug and alcohol programs will be covered by both 42 C.R.F. Part 2 and HIPAA.