How should CCARs approach HIPAA and 42 CFR Part 2 in disclosures?

• A. Share information freely with any service provider to coordinate care.
• B. Obtain consent for disclosures when required; protect PHI, understand limits of 42 CFR Part 2; share information only with authorized individuals for legitimate purposes.
• C. Ignore Part 2 and disclose whenever convenient.
• D. Disclose all information to family members unless client objects.

Answer: (B)

Disclosures must honor client confidentiality under HIPAA and the stricter protections of 42 CFR Part 2, while still allowing care to be coordinated. The best approach is to obtain consent for disclosures when required, protect PHI, understand the limits of Part 2, and share information only with individuals who are authorized and for legitimate purposes. Part 2 places tighter restrictions on substance use treatment records than HIPAA, so disclosures should only occur with a client’s signed authorization or under narrowly defined exceptions, and only to people who need the information to provide or coordinate care. This means you don’t share freely with any service provider, you don’t ignore Part 2, and you don’t disclose everything to family members without the client’s explicit permission. Instead, limit disclosures to what is necessary, ensure authorization is in place when required, and keep information within the boundaries of who is allowed to know and for what purpose.