Healthcare Law Blog

When HIPAA Says Yes but Part 2 Says No, Part Three: Proactive Steps to Take If Your Program Is Under Investigation

In this three-part series, we investigate the duties of SUD providers under Part 2 in the face of subpoenas and investigations. Part One discussed the contours of the duties in the face of a subpoena, while Part Two walked you through what happens when your employees are contacted by investigators. Part Three will guide you throughout the investigatory process.

Receiving a subpoena or learning that your program is under investigation is concerning and stressful, but there are proactive steps you can take to protect your patients, your staff, and your program while demonstrating good faith cooperation.

• Engage Legal Counsel Immediately

Do not attempt to respond to a subpoena, investigative demand, or informal request without consulting an attorney experienced in Part 2 and healthcare regulatory matters. The legal analysis required is complicated and fact-specific. Attorneys are often able to engage in conversations that lead to a limitation of the scope of the subpoena and possibly determine the critical issue that the investigation is focused on. 

• Train Your Staff

All employees should receive training on Part 2 confidentiality obligations, including what to do (and what not to do) if approached by an investigator. This training should be documented and updated regularly. Under the 2024 Final Rule, Part 2 programs are expected to have policies and procedures in place that address confidentiality, complaints, and breach reporting. Having compliant polices and procedures is critically important, but assuring that employees and contractors know the policies and adhere to them is tantamount. When a program receives notice of investigation, a special effort to train employees on privacy obligations is appropriate.

• Identify What You Can Produce

Even under Part 2’s strict protections, there are categories of documents that typically can be produced without a court order because they do not contain patient-identifying information. Voluntarily producing non-protected documents demonstrates cooperation and can reduce friction with the investigating agency. Counsel can negotiate with investigators concerning these documents as well.

• Audit Your Records and Consent Forms

Proactively review your record-keeping practices:

• Are SUD counseling notes and psychotherapy notes maintained separately from the general medical record?
• Are your consent forms updated to comply with the 2024 Final Rule’s requirements for single TPO consent?
• Do you have a current, compliant Notice of Privacy Practices that addresses Part 2-specific protections?
• Are disclosure logs up to date, documenting every instance of SUD records disclosure?

• Preserve Everything, But Produce Nothing Without Authorization

When a program is contacted by an investigator or receives a subpoena, administration should instruct all staff to implement a “litigation hold.” This means that immediately upon learning about an investigation, steps should be taken to ensure that no records are altered, deleted, or destroyed and staff is made aware thereof and instructed accordingly. At the same time, any patient records or patient-identifying information should not be produced unless and until you have confirmed the legal basis for doing so with counsel. The best practice is to produce all records only through counsel to ensure that compliance with Part 2 is maintained.

• Review the Court Order Carefully If One Is Presented

If an investigative agency presents a court order authorizing disclosure, do not assume it is compliant. A Part 2-compliant court order under § 2.66 must contain specific findings and limitations. If the order is deficient, you have the right to seek its revocation or amendment under § 2.66(b).

• Establish a Breach Response Plan

Under the 2024 Final Rule, the HIPAA Breach Notification Rule now applies to Part 2 records. If patient-identifying information is improperly disclosed, whether by your program, an investigative agency, or a third party, you must be prepared to report the breach to affected individuals, OIG, and potentially the media, within HIPAA’s required timelines. Your breach policies and procedures should be reviewed to ensure compliance with regulatory and reporting requirements. Documentation of compliance is important - your privacy officer should maintain the appropriate logs and records.

Practical Takeaways for SUD Providers

• Do not assume a subpoena requires a provider to disclose patient records.
• Always analyze whether Part 2 applies (and in most SUD settings, it does).
• HIPAA alone is not enough to justify disclosure of SUD records.
• Psychotherapy notes and SUD counseling notes deserve special scrutiny and are rarely producible.
• Train your employees to know what to do (and what not to do) if investigators make contact.
• Cooperate where you can, but protect where you must. Voluntarily producing non-protected records demonstrates good faith without violating SUD patient confidentiality.

When in doubt, slow down and seek counsel. Improper disclosure now carries serious federal penalties of up to $2.13 million per violation category per year in civil penalties, and potential criminal liability and the duty to notify patients of the breach.

Medicaid fraud investigations and other government inquiries are serious matters, but so are federal confidentiality obligations. SUD providers walk a narrow path balancing cooperation and compliance. Understanding what the law actually requires is key.

If your organization receives a subpoena or investigative demand involving SUD records, legal guidance early in the process can help protect your patients, your staff, and your program.

Lisa English Hinkle is a Member of McBrayer and chairs the healthcare law practice. Ms. Hinkle is based in the Lexington office. You can contact her at lhinkle@mcbrayerfirm.com or (859) 551-3668.

Valerie Michael is a Member at McBrayer's Lexington office. Ms. Michael focuses her area of practice on healthcare law, handling a wide variety of matters, such as healthcare professional licensure defense, compliance, and regulatory issues. Ms. Michael can be reached at vmichael@mcbrayerfirm.com or (859) 551-3624.