On January 3, 2018 the Substance Use and Mental Health Services Administration (SAMHSA) published a final rule implementing new changes to the Confidentiality of Substance Use Disorder Patient Records, 42 C.F.R. part 2 (Part 2).
The Part 2 privacy regulations govern the confidentiality of substance use disorder (SUD) patient records which are maintained in connection with the performance of any federally assisted substance use disorder program (Part 2 Records). The final rule becomes effective February 2, 2018.
While the new rule maintains the fundamental prohibition on disclosure of Part 2 patient records without patient consent, it expands the ways in which Part 2 patient records may be shared and modernizes notice requirements to align with current healthcare information technology practices.
- Disclosures of Part 2 records to subcontractors are now permitted for payment and healthcare operations with patient consent: When a patient consents to the disclosure of their Part 2 Records for purposes of payment or healthcare operations, the recipient listed on the consent form (Lawful Holder) may further disclose the Part 2 Records to the Lawful Holder’s contractors, subcontractors, or legal representatives (Contractors) as necessary to carry out the payment or health care operations purpose for the disclosure. Under this new rule, Lawful Holders are required to have a written contract in place by February 2, 2020, with certain provisions obligating the Contractors to be bound by, and in compliance with Part 2.
- Although the new rule authorizes disclosures to Contractors for payment and healthcare operations, SAMHSA confirmed that disclosures to Contractors for other purposes, such as diagnosis, treatment, or referral for treatment are not permitted, including care coordination and case management purposes.
- Abbreviated notice of Part 2 prohibition on re-disclosure now permitted to assist users of electronic health record systems (EHRs): When making a disclosure under Part 2, the disclosing party must provide the recipient with notice of the prohibition on re-disclosure. Part 2 prescribes specific language for the notice of the prohibition on re-disclosure that must accompany each disclosure of Part 2 Records. Because many EHRs have a standard maximum character limit of 80 characters in the free text space that may be used to transmit this notice, the new rule provides disclosing parties with the option to use the following abbreviated notice of the prohibition on re-disclosure: “42 CFR part 2 prohibits unauthorized disclosure of these records.”
- Disclosures of Part 2 records to subcontractors for audit and evaluation purposes: Subject to certain limitations, the new rule expands the scope of disclosure of Part 2 Records for purposes of audits and evaluations performed on behalf of federal, state, and local governments providing financial assistance to, or regulating the activities of both P art 2 programs as well as Lawful Holders. In addition, if disclosures are made for a Medicare, Medicaid, or CHIP audit /evaluation, including a civil investigation or administrative remedy, further disclosures may be made to contractors, subcontractors, or legal representatives to carry out the audit or evaluation.
SAMHSA announced that it will hold a public meeting on January 31, 2018 to solicit information and feedback from the public concerning the effect of Part 2 on patient care, health outcomes, and patient privacy, as required by Section 110002 of the 21st Century Cures Act.
Entities that are subject to Part 2 must assess the impact of the new regulation on operations and update policies and procedures to align with the new requirements. If you have questions about the changes to Part 2 or general questions regarding Part 2 compliance, please contact Elana Zana or Anthony Halbeisen.
