Rehab & Drug Abuse Confidentiality (HIPAA & Privacy of Records)
HIPAA, Medical Records & Laws
HIPAA, or Health Insurance Portability and Accountability Act of 1996, is a federal law that protects sensitive patient health information from being shared (disclosed) without a patient’s consent or knowledge.1 This was initially created and enacted to help “improve the use (portability) and accountability of health insurance coverage” for employees between jobs.2 HIPAA evolved to include privacy and security rules around Protected Health Information (PHI) in personal medical records.2 A person’s demographics, health status, where they received care, and how they paid for their care are all examples of PHI that can identify an individual.2
To make HIPAA stronger, the US Department of Health and Human Services (HHS) developed HIPAA’s national standards with a Privacy Rule for all healthcare providers to follow as well as other “covered entities” (e.g., health plans, claims processing centers, utilization review, billing departments).1
In an age of computerized records and the flow of electronic health information back and forth between healthcare providers, HIPAA stands to protect our personal medical information. Regardless of why a person seeks treatment for their health, it is their right to keep information private. The Privacy Rule allows personal medical information to be processed in a standard format while protecting the privacy of people who seek health care.1 If the person wishes to share their health information beyond the “covered entities” they have the right to give special permission.
Is Rehab Confidential?
People who are being treated for a substance use disorder (SUD) have additional protection in place with the Code of Federal Regulations (CFR) Title 42 Part 2.3 This regulation was enacted in 1975 to address concerns related to using SUD information in domestic or criminal proceedings.3 42 CFR Part 2 protects a person’s SUD information; it cannot be disclosed without consent, as it could present a barrier to treatment lead to adverse consequences for people diagnosed with SUD outside a healthcare setting. 3
The confidentiality of alcohol and drug abuse patient records maintained by us is protected by Federal law and regulations. Generally, we may not say to a person outside the treatment center that you are a patient of the treatment center, or disclose any information identifying you as an alcohol or drug abuser unless:
- You consent in writing (as discussed below in “Authorization to Use or Disclose PHI”);
- The disclosure is allowed by a court order (as discussed below in “Uses and Disclosures”); or
- The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation (as discussed below in “Uses and Disclosures”).
Violation of the Federal law and regulations by the treatment center is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations.
When you enroll in a rehab program, the intake specialist or admission navigator will usually provide you with the required information on HIPAA up-front. They will also typically ask you to read and sign paperwork that confirms you were given the information and that you understand your rights related to HIPAA.
Rehab centers will also provide you information on consent forms. Consent forms give staff permission to share your health information with others besides your clinical team.4 It may be important to you that your family be free to talk to your counselor or doctor about your care during your rehab stay. If you sign a consent for a family member, they can call and receive brief updates.
Consent forms are very specific as to “who” the rehab staff can disclose your health information to and for what purpose.4 Consent forms also clearly state the amount and kind of health information to be shared.4 For instance, a person may want their spouse to be updated on their progress during treatment. The consent form would identify the spouse by first and last name along with what PHI can be shared from your health record related to your care.
If a patient does not give the rehab team consent to disclose SUD health information, then no one, including their parents, spouse, friends, or family members, will be given any information. The added protection under 42 CFR Part 2 even removes staff from being able to verify your presence in the rehab program altogether should someone call in. Even access to talk to a therapist is denied. Unless a person is on a release of information (consent) form with your expressed approval, information will not be shared. The only way they could discover that you are in rehab or were in rehab is if you tell them.
Consent forms can be revoked at any time either in part or in whole. When consent is revoked for Part 2 programs, the revocation should be immediately communicated to the rehab center team. Revoking a consent can be given orally or in writing, and documented in the patient’s record.4
Healthcare providers that work in addiction treatment centers are specially trained in HIPAA and 42 CFR Part 2 regulations to ensure your privacy is upheld to the fullest extent of the law.
Rehab insurance coverage fully or partially covers substance abuse treatment. Curious whether your insurance will cover addiction treatment at American Addiction Centers or another rehabilitation center? Simply fill out the form below and an admissions navigator will contact you to explain your behavioral health benefits.
Reasons People Want to Keep Rehab Confidential
There are a variety of reasons why someone might want to keep rehab confidential. Some reasons may include:
- The stigma of addiction and shame
- Employment prospects
- Fear of a record
Despite the reason, there are laws in place to protect you or your loved one’s privacy.
Doctor-Patient Confidentiality & Drug Use
Doctor-patient confidentiality (doctor-patient privilege) is very important and occurs when you communicate with your doctor what your concerns are, what worries you about your health, and other personal information that typically occurs during a doctor’s visit. The information shared is protected.5 If you tell your doctor that you have been using drugs or drinking alcohol in risky ways (e.g., while driving, or illegally) the doctor cannot have you arrested or send you to jail. HIPAA protects you from the provider sharing (disclosing) your information to non-treatment entities.3
Your health and the care you need are of the utmost importance to your doctor. Being honest about what has happened to you gives your physician the most accurate health information to help you. The doctor may recommend certain types of treatment or other therapeutic modalities, but they cannot “send” you to rehab or jail for using substances.
Doctors do have the authority to send patients to an acute care hospital for an evaluation if a medical or psychiatric emergency presents itself. Those that are a risk to themselves or others meet this criterion and are treated for a specific condition, stabilized, and then medically cleared before being admitted to a rehab program.
Records & Background Checks
No, prior rehab or drug use will not show up on any of your legal records. However, if you committed a crime or felony that was drug-related, then this may show up on our record or in a background check.
While there is no shame in seeking treatment, and there is currently a high prevalence of addiction and addiction treatment in the United States, some people may still wish to conceal the fact that they’re getting help and attending rehab due to the stigma that exists around drug and alcohol abuse issues. HIPAA and 42 CFR Part 2 are in place to keep your information secure.
Under What Circumstances Could Information Protected by HIPAA be Disclosed?
There are some circumstances where protected health information could be disclosed prematurely or in an unusual manner. One example is if you receive care from a qualified service organization (QSOA) that provides multiple services, including a Part 2 program, that uses a Health Information Exchange (HIE) network. HIEs allow data to be shared among the organization to support your care (e.g., accounting, billing, laboratory, pharmacy). All QSOA’s enter into a written agreement and are bound by all 42 CFR Part 2 rules.6
Penalties for Disclosing Information
Penalties can be handed down to doctors, health organizations, and other covered entities through the Enforcement Final Rule of 2006 law who, knowingly or unknowingly, disclose Protected Health Information without a person’s consent.6
The Department of Health Services’ Office for Civil Rights (OCR) and the state attorney general can issue the violation.7The violation can result in either a financial fine or a corrective action plan or both.7 Financial penalties can be substantial and are in place to prevent breaches of HIPAA laws “holding covered entities accountable for their actions” in safeguarding the privacy of patients and the confidentiality of health information.7