Close X
Attorney Spotlight

How did an interest in healthcare policy lead Robert Platt to a career in the law? Find out more>


Close X


Search our Experience

Experience Spotlight

Envision to Sell to KKR for $9.9 Billion

We represented Envision Healthcare Corporation (NYSE: EVHC) in its definitive agreement to sell to KKR in an all-cash transaction for $9.9 billion, including debt. KKR will pay $46 per Envision share in cash to buy the company, marking a 32 percent premium to the company's volume-weighted average share price from November 1, when Envision announced it was considering its options. The transaction is expected to close the fourth quarter of 2018. Read more

Envision Healthcare

Close X

Thought Leadership

Enter your search terms in the relevant box(es) below to search for specific Thought Leadership.
To see a recent listing of Thought Leadership, click the blue Search button below.

Thought Leadership Spotlight

Six Things to Know Before Buying a Physician Practice spotlight

Dermatology, ophthalmology, radiology, urology…the list goes on. Yet, in any physician practice management transaction, there are six key considerations that apply and, if not carefully managed, can derail a transaction. Download the 6 Things to Know Before Buying a Physician Practice to keep your physician practice management transactions on track.

Click here to download the guide.

SAMHSA Further Revises the Part 2 Drug and Alcohol Abuse Confidentiality Requirements

Firm Publication


January 11, 2018

On January 3, 2018, the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration (SAMHSA) issued a final rule1 to implement modifications to the Confidentiality of Substance Use Disorder Patient Records regulations, 42 CFR Part 2 (Part 2 Regulations). The Final Rule addresses changes that were proposed in a supplemental notice of proposed rulemaking, issued on January 18, 2017,2 concurrently with SAMHSA's final rule to implement the first major, substantive revisions to the Part 2 Regulations in several decades (2017 Rule). Read more about the 2017 Rule here

The Part 2 Regulations govern providers of substance abuse treatment, diagnosis and referral for treatment (including facilities, medical personnel and specialized units within inpatient settings) that are federally assisted. These regulations impose stringent limitations on the use and disclosure of patient-identifying information by substance abuse treatment providers and the recipients of such information. 

In the 2017 Rule, SAMHSA did not address, and instead issued a supplemental proposed rulemaking to seek comment on, the following issues: 

  1. Payment and operations disclosures that may be made to contractors and subcontractors under the consent provisions of the Part 2 Regulations;
  2. Permissibility of using an abbreviated notice of the prohibition on re-disclosure; and
  3. Disclosures for Medicare, Medicaid and other federal program audits or evaluations.

Summary of the Major Provisions of the Final Rule

  • Disclosures by Lawful Holders for Payment and (Limited) Health Care Operations: SAMHSA finalizes limitations and conditions for disclosure of patient-identifying information by Part 2 Programs and entities who have received such information from a Part 2 Program with patient consent (lawful holders) to their contractors, subcontractors and legal representatives (collectively, subcontractors) for payment and health care operations purposes.
    • Rather than promulgate its proposed list of the payment and health care operations disclosures permitted by lawful holders, SAMHSA reserved the list for preamble guidance to the Final Rule. Significantly, SAMHSA did modify the regulations to state that such permitted activities do not include substance use disorder patient diagnosis, treatment or referral for treatment. Further, SAMHSA takes the position in preamble guidance that disclosures by lawful holders for care coordination and case management, and disclosures to subcontractors to carry out these purposes, are expressly disallowed (in contrast, under HIPAA, disclosures for care coordination and case management are considered to be health care operations). Therefore, disclosures for care coordination and care management from a program or lawful holder (such as a health plan wishing to manage the care of enrollees) will require express consent by the patient.
    • Agreements between lawful holders and subcontractors to carry out permitted payment and health care operations involving the use or disclosure of patient information must include contract provisions requiring subcontractors to comply with the Part 2 Regulations. SAMHSA does not require specific contract language, recognizing that entities may use different approaches to ensure compliance with the Part 2 Regulations and other laws. SAMHSA acknowledges the burden of updating contracts to comply with these requirements and allows lawful holders two years from the Final Rule's effective date (or before February 2, 2020) to update contracts with subcontractors.
    • Although lawful holders may disclose patient information to subcontractors for payment and limited health care operations, further disclosures by the subcontractor are strictly limited. Under the rule, contracts between lawful holders and subcontractors may not permit a subcontractor to re-disclose information to a third party unless (1) that third party is an agent of the subcontractor who is helping provide services described in the contract, and (2) the agent only further discloses the information back to the subcontractor or lawful holder from which the information originated. Thus, it appears that consent from the patient would be required before the agent could disclose information to any of its vendors, to a provider involved in the patient’s care or for payment or health care operations purposes. Also, it appears that a subcontractor receiving information from a lawful holder is required to obtain patient consent before further disclosing the information to any vendor that is an independent contractor, but not an agent, of the subcontractor.
  • Abbreviated Notice for Re-disclosure: The Part 2 Regulations require that when patient-identifying information is disclosed with patient consent, the disclosure be accompanied by written notice of the prohibition on re-disclosing information. In the Final Rule, SAMHSA adopts an abbreviated notice ("42 CFR part 2 prohibits unauthorized disclosure of these records") as an alternative to the more lengthy statement. SAMHSA implements this change in part to accommodate standard free-text space within an electronic health records system, though this abbreviated notice may be used whether in paper or electronic form. In the preamble to the Final Rule, SAMHSA encourages those using the abbreviated notice to discuss the prohibition on re-disclosure with data recipients. Further, the Final Rule requires that a notice of prohibition of re-disclosure be provided to all subcontractors.
  • Disclosures for Audit and Evaluations: The Final Rule clarifies that for audits undertaken by Medicare, Medicaid or the Children's Health Insurance Program, further disclosures may be made to subcontractors to carry out the audit or evaluation without patient consent. Subcontractors receiving information for these purposes may only disclose the information back to the lawful holder from which it was obtained, and they may use the information only in carrying out the audit or evaluation purpose or as otherwise permitted by the Part 2 Regulations.

The Final Rule becomes effective on February 2, 2018, with the exception of the contracting requirements, which must be implemented on or before February 2, 2020. SAMHSA plans to hold a public meeting to obtain additional input from stakeholders about the effect of the Part 2 Regulations on patient privacy, health outcomes and patient care. The public meeting is tentatively scheduled for January 31, 2018.

For questions or more information about the Part 2 Rule, contact the authors listed above.

83 Fed. Reg. 239 (Jan. 3, 2018) (the "Final Rule").
82 Fed. Reg. 5485 (Jan. 18, 2017).

Related Professionals

Related Services


Visiting, or interacting with, this website does not constitute an attorney-client relationship. Although we are always interested in hearing from visitors to our website, we cannot accept representation on a new matter from either existing clients or new clients until we know that we do not have a conflict of interest that would prevent us from doing so. Therefore, please do not send us any information about any new matter that may involve a potential legal representation until we have confirmed that a conflict of interest does not exist and we have expressly agreed in writing to the representation. Until there is such an agreement, we will not be deemed to have given you any advice, any information you send may not be deemed privileged and confidential, and we may be able to represent adverse parties.