Records of patients in federally assisted substance use disorder programs are protected by 42 CFR Part 2, which generally limits disclosure without patient consent and restricts use of the records in legal proceedings. HIPAA applies to most treatment providers as well, and state mental health and confidentiality laws can add further limits.

We help providers determine which rules govern a given record or disclosure and build workable practices around them. That includes consent forms, notices of privacy practices, policies for sharing information with other providers, payors and family members, and procedures for responding to requests from patients.

When a subpoena, court order or law enforcement request arrives, we advise on whether and how the provider may respond, and we appear on the provider's behalf where a court order is required. When there is an unauthorized disclosure or a complaint, we assist with breach assessment and notification and represent the provider before regulators.

We also advise on data sharing arrangements, electronic health record and telehealth vendor agreements, and the risk assessments and workforce training that regulators expect.