How do HIPAA and 42 CFR Part 2 interact in the context of a Peer Support Specialist?

• A. 42 CFR Part 2 overrides HIPAA in all cases.
• B. HIPAA governs protected health information; 42 CFR Part 2 provides stricter confidentiality for substance use treatment records; disclosures should comply with both, with patient consent.
• C. HIPAA and 42 CFR Part 2 are unrelated.
• D. Disclosures can always be made without consent.

Answer: (B)

HIPAA sets the baseline for protecting health information, while 42 CFR Part 2 adds an extra layer of protection specifically for substance use treatment records. For a Peer Support Specialist, this means that information about a person’s SUD treatment is particularly sensitive and must be handled with Part 2’s stricter rules in mind. Any disclosure of that information should occur only with a Part 2–compliant patient consent that clearly names who may receive the information, what can be shared, and for what purpose.

When both rules can apply, you must meet both standards, with Part 2’s limits guiding disclosures of treatment records. The released information should not go beyond what the consent permits, and recipients should use it only for the stated purpose. In most cases, you should obtain a consent that satisfies Part 2 requirements (and also aligns with HIPAA) before sharing with the peer support specialist.

Disclosures without consent are not generally allowed; Part 2 has special restrictions and only allows certain, limited exceptions (emergencies, certain mandated disclosures) under strict conditions. This is why the correct approach is to rely on a Part 2–compliant consent and ensure disclosures respect both regimes.