SAMHSA Further Revises the Part 2 Drug and Alcohol Abuse Confidentiality Requirements

On January 3, 2018, the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration (SAMHSA) issued a final rule¹ to implement modifications to the Confidentiality of Substance Use Disorder Patient Records regulations, 42 CFR Part 2 (Part 2 Regulations). The Final Rule addresses changes that were proposed in a supplemental notice of proposed rulemaking, issued on January 18, 2017,² concurrently with SAMHSA’s final rule to implement the first major, substantive revisions to the Part 2 Regulations in several decades (2017 Rule). Read more about the 2017 Rule here.

The Part 2 Regulations govern providers of substance abuse treatment, diagnosis and referral for treatment (including facilities, medical personnel and specialized units within inpatient settings) that are federally assisted. These regulations impose stringent limitations on the use and disclosure of patient-identifying information by substance abuse treatment providers and the recipients of such information.

In the 2017 Rule, SAMHSA did not address, and instead issued a supplemental proposed rulemaking to seek comment on, the following issues:

1. Payment and operations disclosures that may be made to contractors and subcontractors under the consent provisions of the Part 2 Regulations;
2. Permissibility of using an abbreviated notice of the prohibition on re-disclosure; and
3. Disclosures for Medicare, Medicaid and other federal program audits or evaluations.

Summary of the Major Provisions of the Final Rule

• Disclosures by Lawful Holders for Payment and (Limited) Health Care Operations: SAMHSA finalizes limitations and conditions for disclosure of patient-identifying information by Part 2 Programs and entities who have received such information from a Part 2 Program with patient consent (lawful holders) to their contractors, subcontractors and legal representatives (collectively, subcontractors) for payment and health care operations purposes.
  • Rather than promulgate its proposed list of the payment and health care operations disclosures permitted by lawful holders, SAMHSA reserved the list for preamble guidance to the Final Rule. Significantly, SAMHSA did modify the regulations to state that such permitted activities do not include substance use disorder patient diagnosis, treatment or referral for treatment. Further, SAMHSA takes the position in preamble guidance that disclosures by lawful holders for care coordination and case management, and disclosures to subcontractors to carry out these purposes, are expressly disallowed (in contrast, under HIPAA, disclosures for care coordination and case management are considered to be health care operations). Therefore, disclosures for care coordination and care management from a program or lawful holder (such as a health plan wishing to manage the care of enrollees) will require express consent by the patient.
  • Agreements between lawful holders and subcontractors to carry out permitted payment and health care operations involving the use or disclosure of patient information must include contract provisions requiring subcontractors to comply with the Part 2 Regulations. SAMHSA does not require specific contract language, recognizing that entities may use different approaches to ensure compliance with the Part 2 Regulations and other laws. SAMHSA acknowledges the burden of updating contracts to comply with these requirements and allows lawful holders two years from the Final Rule’s effective date (or before February 2, 2020) to update contracts with subcontractors.
  • Although lawful holders may disclose patient information to subcontractors for payment and limited health care operations, further disclosures by the subcontractor are strictly limited. Under the rule, contracts between lawful holders and subcontractors may not permit a subcontractor to re-disclose information to a third party unless (1) that third party is an agent of the subcontractor who is helping provide services described in the contract, and (2) the agent only further discloses the information back to the subcontractor or lawful holder from which the information originated. Thus, it appears that consent from the patient would be required before the agent could disclose information to any of its vendors, to a provider involved in the patient’s care or for payment or health care operations purposes. Also, it appears that a subcontractor receiving information from a lawful holder is required to obtain patient consent before further disclosing the information to any vendor that is an independent contractor, but not an agent, of the subcontractor.
• Abbreviated Notice for Re-disclosure: The Part 2 Regulations require that when patient-identifying information is disclosed with patient consent, the disclosure be accompanied by written notice of the prohibition on re-disclosing information. In the Final Rule, SAMHSA adopts an abbreviated notice (“42 CFR part 2 prohibits unauthorized disclosure of these records”) as an alternative to the more lengthy statement. SAMHSA implements this change in part to accommodate standard free-text space within an electronic health records system, though this abbreviated notice may be used whether in paper or electronic form. In the preamble to the Final Rule, SAMHSA encourages those using the abbreviated notice to discuss the prohibition on re-disclosure with data recipients. Further, the Final Rule requires that a notice of prohibition of re-disclosure be provided to all subcontractors.
• Disclosures for Audit and Evaluations: The Final Rule clarifies that for audits undertaken by Medicare, Medicaid or the Children’s Health Insurance Program, further disclosures may be made to subcontractors to carry out the audit or evaluation without patient consent. Subcontractors receiving information for these purposes may only disclose the information back to the lawful holder from which it was obtained, and they may use the information only in carrying out the audit or evaluation purpose or as otherwise permitted by the Part 2 Regulations.

The Final Rule becomes effective on February 2, 2018, with the exception of the contracting requirements, which must be implemented on or before February 2, 2020. SAMHSA plans to hold a public meeting to obtain additional input from stakeholders about the effect of the Part 2 Regulations on patient privacy, health outcomes and patient care. The public meeting is tentatively scheduled for January 31, 2018.

For questions or more information about the Part 2 Rule, contact the authors listed above.

¹ 83 Fed. Reg. 239 (Jan. 3, 2018) (the “Final Rule”).
² 82 Fed. Reg. 5485 (Jan. 18, 2017).