SAMHSA Finalizes Additional Changes to the Confidentiality of Substance Use Disorder Patient Records Regulations

Download a PDF of this piece

Executive Summary

On January 3, 2018, the Substance Abuse and Mental Health Services Administration (“SAMHSA”) published a final rule (“Final Rule”) to further update the Confidentiality of Substance Use Disorder Patient Records regulations (“Part 2 Regulations” or “Part 2”).[1] The Final Rule comes one year after SAMHSA’s publication of a prior final rule (“2017 Part 2 Rule”) that provided the first substantive update to the Part 2 Regulations since 1987.[2] The regulatory changes included in the 2017 Part 2 Rule are discussed in the Epstein Becker Green Client Alert titled “SAMHSA Finalizes Its Changes to the Confidentiality of Substance Use Disorder Patient Records Regulations.”[3]

Concurrent with its release of the 2017 Part 2 Rule, SAMHSA issued a supplemental notice of proposed rulemaking (“SNPRM”) to seek public comment on additional proposals not addressed in the 2017 Part 2 Rule, including circumstances under which lawful holders of substance use disorder (“SUD”) patient records and their legal representatives, contractors, and subcontractors may use and disclose patient identifying information for purposes of payment, health care operations, and audits and evaluations, as well as circumstances under which an abbreviated notice of the prohibition on re-disclosure should be used.[4]

The Final Rule addresses the proposed changes included in the SNPRM and attempts to better align the Part 2 Regulations with advances in the U.S. health care delivery system, while retaining privacy protections for individuals seeking treatment for SUDs. The changes in the Final Rule are effective on February 2, 2018, except that lawful holders of SUD patient records have until February 2, 2020, to ensure that their agreements with contractors, subcontractors, and legal representatives comply with the new requirements of 42 C.F.R. § 2.33(c).

Overview of the Part 2 Regulations

The Part 2 Regulations, which implemented the federal drug and alcohol confidentiality law (42 U.S.C. § 290dd-2), protect the confidentiality of the identity, diagnosis, prognosis, or treatment of any patient records maintained in connection with the performance of any federally assisted program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research. The Part 2 Regulations apply to federally assisted programs that hold themselves out to the public as providing, and actually provide, SUD diagnosis, treatment, or referral for treatment, including identified units or medical personnel or other staff within a general medical facility. Part 2 also applies to other lawful holders of patient identifying information (e.g., individuals or entities that receive records pursuant to a Part 2-compliant patient consent).

Details of SAMHSA’s Changes in the Final Rule

Since their original publication, the Part 2 Regulations have required that covered parties making a disclosure of SUD records pursuant to a patient’s written consent must include with the disclosed records a written notice that the records are subject to Part 2 and that re-disclosure without additional patient consent is prohibited. In the Final Rule, SAMHSA adopted an abbreviated notice of the prohibition on re-disclosure that can be used in any instance in which a notice is required under 42 C.F.R. § 2.32. The abbreviated notice reads as follows: “Federal law/42 CFR part 2 prohibits unauthorized disclosure of these records.” The abbreviated notice is less than 80 characters long so that it fits within the standard free-text space in most electronic health record systems. In order to alleviate concerns that the abbreviated notice may be insufficient to convey understanding of the Part 2 requirements, SAMHSA encourages Part 2 programs and other lawful holders using the abbreviated notice to discuss the requirements with those to whom they disclose patient identifying information.

The Final Rule makes a number of important changes to the rules governing the re-disclosure of elements of patient records by lawful holders of patient identifying information. These include efforts to align the process for re-disclosure of records necessary for payment and health care operations under Part 2 with the Health Insurance Portability and Accountability Act (“HIPAA”) regulations, to the extent possible.

The Final Rule allows lawful holders to re-disclose the minimum amount of information necessary to contractors, subcontractors, and legal representatives for purposes of payment and health care operations. Although this provision is an attempt to align the re-disclosure rules with the HIPAA exception for health care operations, the Final Rule makes it clear that the Part 2 provision should be read more narrowly. In particular, SAMHSA added language to the regulatory text in 42 C.F.R. § 2.33(b) to clarify that disclosures to contractors, subcontractors, and legal representatives are not permitted to carry out other purposes, such as activities related to patient diagnosis, treatment, or referral for treatment. As such, although lawful holders will now be able to re-disclose certain information, such re-disclosures must be narrowly restricted to information necessary for payment and health care operations.

In the SNPRM, SAMHSA proposed a list of 17 distinct payment and health care operations activities for which a lawful holder of patient identifying information would be allowed to re-disclose the minimum amount of information necessary without additional patient consent. In the Final Rule, SAMHSA removed the list from the regulatory text but included it, unaltered, in the preamble as a non-exhaustive, illustrative list of the types of permissible payment and health care operations activities that would justify re-disclosure. As such, SAMHSA expressly acknowledges that the re-disclosure of other appropriate payment and health care operations activities may be permitted by lawful holders. 

Although many commenters requested that SAMHSA include care coordination, case management, and other “treatment-related” activities on the list of activities for which re-disclosure is allowed, SAMHSA refused to do so in the Final Rule. Instead, SAMHSA added an explicit statement to the regulatory text to make clear that re-disclosures to carry out activities related to SUD patient diagnosis, treatment, or referral for treatment are not permissible payment or health care operations activities. In this key aspect, the re-disclosure provisions are more restrictive than those in the HIPAA Privacy Rule (which allows for the disclosure of information for treatment, payment, or health care operations, and which includes case management and care coordination activities under its definition of “health care operations”).

In addition to the list of payment and health care operations activities included in the preamble to the Final Rule, SAMHSA intends to allow for re-disclosures of Part 2 patient identifying information for other “appropriate” payment and health care operations activities. As such, lawful holders should carefully review the reasons why they would like to share Part 2 information to determine if re-disclosure can be supported as a permissible payment or health care operations activity.

In the SNPRM, SAMHSA stated that it was critical that “contractors, subcontractors, and legal representatives understand their obligations with respect to [Part 2] patient identifying information.” To that end, in the Final Rule, SAMHSA adopted requirements for lawful holders that contract with third parties to carry out payment and health care operations to include specific language in the contract with such parties addressing compliance with Part 2 requirements. Under circumstances where no such contract exists, a separate, comparable legal instrument may be used to require that the contractor, subcontractor, or voluntary legal representative be bound by the provisions of Part 2 upon receipt of patient identifying information.

In the Final Rule, SAMHSA removed a proposed requirement that the contract must specify the permitted uses of patient identifying information by the contractor, subcontractor, or voluntary legal representative. In doing so, SAMHSA noted that 42 C.F.R. § 2.13 already requires that any disclosure must be limited to that information which is necessary to carry out the purpose of the disclosure. SAMHSA also noted that lawful holders should ensure that the purpose section of the patient consent form is consistent with the role of, or services provided by, the contractor or subcontractor (e.g., “payment and health care operations”) in order to comply with 42 C.F.R. § 2.13.

Further, while commenters proposed the inclusion of specific contract language under 42 C.F.R. § 2.33(c), SAMHSA declined to require or provide specific contract language to be used between the parties, stating that lawful holders need the flexibility to include language that fits within their contract structures. The Final Rule gives lawful holders until February 2, 2020, to bring their contracts and legal instruments with contractors, subcontractors, and legal representatives into compliance with the requirements of 42 C.F.R. § 2.33(c).

In response to the SNPRM, SAMHSA received other miscellaneous comments regarding disclosures by lawful holders. SAMHSA issued the following responses to these comments, providing a number of key clarifications:

The Part 2 Regulations at 42 C.F.R. § 2.53 include procedures for federal, state, or local government agencies providing financial assistance to a Part 2 program to have access to patient records, without a patient’s consent, in order to audit and evaluate activities, such as financial and quality assurance functions critical to accountable care organizations and other health care organizations.

The Final Rule clarifies that patient identifying information may be disclosed to individuals or entities that perform audits and evaluations on behalf of federal, state, and local governments providing financial assistance to, or regulating the activities of, lawful holders as well as Part 2 programs. If disclosures are made to an individual or entity under this section for a Medicare, Medicaid, or Children’s Health Insurance Program audit or evaluation, including a civil investigation or administrative remedy, further disclosures may be made to the individual’s or entity’s contractors, subcontractors, or legal representatives to carry out the audit or evaluation. In addition, audits and evaluations may be performed by individuals or entities on behalf of third-party payers or quality improvement organizations, or their contractors, subcontractors, or legal representatives. Patient identifying information disclosed for purposes of an audit or evaluation may be disclosed back only to the Part 2 program or other lawful holder from which it was obtained and may be used only to carry out an audit or evaluation purpose or to investigate or prosecute criminal or other activities, as authorized by a court order entered under 42 C.F.R. § 2.66.

SAMHSA received comments expressing concern that permitting re-disclosure to contractors and subcontractors for purposes of carrying out an audit or evaluation (i) greatly increases the number of individuals who may receive protected information, (ii) could lead to patient records being used for risk adjustment and reporting purposes, and (iii) could impact a patient’s health coverage or health score. SAMHSA responded that it will take requests for additional safeguards and restrictions under advisement for potential future rulemaking, and it cautioned that patient identifying information disclosed pursuant to an audit may be used only for audit and evaluation purposes.

In the SNPRM, SAMHSA requested public comment on a number of policy issues related to Part 2. These included the mechanism to convey the scope of the written consent to lawful holders and their downstream entities, a range of other restrictions and safeguards, and the implications of the proposed revisions for the privacy and confidentiality of SUD patient records in general.

The 2017 Part 2 Rule amended the Part 2 Regulations to permit patients to include a general designation for individuals and/or entities with a treating provider relationship (e.g., “my treating providers”) in the “To Whom” section of the consent form in order to allow for their records to be disclosed to any such providers. This was a significant revision to the preexisting regulations, which required that each provider be specifically named on the consent form. However, the 2017 Part 2 Rule provided that the amount and kind of SUD treatment information that may be disclosed must be expressly specified on the consent form. This could be specified broadly (e.g., “all my substance use disorder information”) or more granularly (e.g., medications, substance use history, employment information, living situation, and/or social supports). The SNPRM sought public comment on how to best effectuate the communication of the scope of written consent to Part 2 programs, lawful holders, and their downstream entities.

In the Final Rule, SAMHSA clarified that the consent form itself is not required to accompany the Part 2 records as a part of a disclosure or allowed re-disclosure. Otherwise, the Final Rule did not provide any additional clarification on the required mechanism for conveying the scope of the authorization. As such, Part 2 programs, lawful holders, and their downstream entities should ensure compliance with the required notice of the prohibition on re-disclosure and otherwise must determine the best way to communicate the scope of the underlying written consent. One of the most important aspects of the scope of consent that should be communicated is whether a particular consent covers all, or only a subset, of the information in the record.

In response to the SNPRM, SAMHSA received a number of comments regarding the establishment of appropriate restrictions and safeguards in various circumstances in order to maintain the core protections afforded to patients’ SUD records under Part 2. In general, commenters expressed concern that broader dissemination of a patient’s treatment information could lead to that information becoming known by friends, family, employers, insurers, and other providers of medical services, which, in turn, could lead to negative consequences for the patient, such as loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, and arrest, prosecution, and incarceration.

SAMHSA did not adopt additional restrictions or safeguards in the Final Rule. The agency states that the existing restrictions and safeguards are adequate, including provisions limiting the use of patient identifying information in criminal and civil procedures and requiring that any disclosure made under the Part 2 Regulations must be limited to that information which is necessary to carry out the purpose of the disclosure. However, SAMHSA did identify a number of areas on which it may consider additional rulemaking in the future, including adding a notification to patients on the consent form indicating that they are consenting to the disclosure of their patient identifying information to both the recipient and the recipient’s contractors, subcontractors, and legal representatives to carry out payment or health care operations; adding mechanisms to enable individuals who have been adversely impacted by an improper disclosure to identify the source of a disclosure, including the addition of a List of Disclosures requirement for contractors, subcontractors, and legal representatives; and strengthening language regarding a patient’s right to file a grievance or complaint.

Consistent with the mandate in the 21st Century Cures Act, prior to March 21, 2018, the Secretary of Health and Human Services will convene relevant stakeholders to determine the effects of the Part 2 Regulations on patient care, health outcomes, and patient privacy.[6] This meeting will provide stakeholders with an additional opportunity to provide input to SAMHSA regarding implementation of Part 2, including changes adopted in the Final Rule, and will inform the course of future Part 2 rulemaking. The stakeholder meeting will include a discussion on the scope of re-disclosure by lawful holders authorized by the Final Rule.

SAMHSA expects that the changes made in the Final Rule will enhance information sharing and the efficiency of such payment and health care operations as claims processing, business management, training, and customer service and will facilitate audit and evaluation activities. Further, SAMHSA expects that the re-disclosure provisions will make it easier for some Part 2 programs and other lawful holders to use electronic health record systems and will reduce regulatory burdens. Accordingly, Part 2 programs and other lawful holders need to be aware of how the additional changes in the Final Rule impact their ability to comply with the Part 2 Regulations. They also need to continue to be mindful of how the Part 2 requirements differ from other health privacy laws, such as HIPAA. Finally, they should continue to engage with SAMHSA through the forthcoming stakeholder meeting and through future rulemaking efforts to ensure that the Part 2 Regulations provide appropriate flexibility in allowing for disclosures of Part 2 patient identifying information while continuing to maintain the confidentiality of SUD patient records.

*  *  *

This Client Alert was authored by Helaine I. Fingold, Lesley R. Yeung, Gregory R. Mitchell, and Kevin J. Malone. For additional information about the issues discussed in this Client Alert, please contact one of the authors or the Epstein Becker Green attorney who regularly handles your legal matters.

ENDNOTES