On July 15, 2020, the Substance Abuse and Mental Health Services Administration (“SAMHSA”) published a final rule revising federal regulations under 42 CFR Part 2 (“Part 2”) governing the confidentiality of Substance Use Disorder (“SUD”) patient records (the “Final Rule”). Much of the Final Rule adopts the proposed changes published in the Notice of Proposed Rule Making released in August 2019. In concert with previous changes adopted in 2017 and 2018, the Final Rule signals SAMHSA’s continuing effort to facilitate the provision of well-coordinated care while also ensuring that core Part 2 confidentiality protections are maintained. The revised Part 2 regulations go into effect on August 14, 2020.
Some of the more significant revisions in the Final Rule include changes to the definition of “records”. The Final Rule clarifies that information conveyed orally between a Part 2 program and a non-Part 2 provider for treatment purposes with consent of the patient will not be considered a “record” subject to Part 2 regulations merely because the Part 2 information is reduced to writing by the non-Part 2 provider. Moreover, treatment records created by non-Part 2 providers based on their own patient encounters are explicitly exempted from Part 2, unless SUD records received from a Part 2 program are incorporated into such records. SAMSHA says this change is meant to facilitate coordination of care activities between Part 2 programs and non-Part 2 providers.
The Final Rule also revises some consent form requirements, though many Part 2 programs will likely wish that SAMHSA had gone further to simplify this process. The new consent rule allows patients to consent to disclosure of their information to a wider range of entities with whom they do not have a treatment relationship without having to name a specific individual to receive the information. Part 2 patients may now consent to the release of their information to non-medical services or benefits providers (e.g., social security benefits, local sober living, or halfway houses) simply by entering the entity name rather than the name of a specific individual on the “to whom” line of the consent form. The goal of this change is to remove the previous burden of having to name a specific individual at an entity, thereby facilitating patient applications for benefits or other resources.
In order to resolve lingering questions about what activities constitute “payment and health care operations”, the Final Rule includes an illustrative list of 18 activities that fall within such definitions. The list, which was previously included in the preamble of the 2018 Final Rule, is now expressly incorporated into the regulations and has been expanded to include care coordination and case management activities. As a result, care coordination and case management activities are included as purposes for which a “lawful holder” who has received Part 2 information with the patient’s consent may make further disclosures as necessary for its contractors, subcontractors and/or legal representatives to support its payment and health care operations. It continues to be the rule that Part 2 information disclosed pursuant to a patient consent for treatment purposes, such as SUD diagnosis, treatment, or referral, may not be further disclosed to a lawful holder’s contractors, subcontractors, or legal representatives without the patient’s express consent. The requirement to obtain express written consent to disclosures for treatment purposes is one area where Part 2 rules differ significantly from HIPAA, which allows disclosure between treatment providers without a patient’s written authorization.
In addition to the changes mentioned above, the Final Rule expands the list of medical emergencies during which disclosures are permitted to include state or federally declared natural disasters.
Important changes were made to permit disclosures for research purposes of Part 2 patient data by HIPAA covered entities to individuals and organizations who are neither HIPAA covered entities nor subject to the Common Rule (45 CFR Part 46). Such disclosures, however, must be made in accordance with the HIPAA Privacy Rule Standards (45 CFR 164.512(i)). This change is intended to align the Part 2 requirements for research disclosures of SUD data with analogous requirements for the conduct of research on human subjects that may apply under other federal regulations in specific circumstances (i.e., institutional review board requirements).
SAMHSA provides guidance in the Final Rule on how Part 2 program staff, including employees, volunteers, and trainees, should handle communications when using personal devices and/or accounts. In cases where patient contact is made through a staff member’s personal email or cell phone account that is not used in the regular course of business for the Part 2 program, the staff member should immediately delete the information from his or her personal account and only respond via an authorized channel provided by the Part 2 program, unless responding directly from the personal account is required to protect the best interests of the patient. Once immediate needs are addressed, the messages should be forwarded to an authorized channel (if containing patient identifying information) and deleted from the personal device. Eliminating the use of personal accounts will assist Part 2 programs with record-keeping responsibilities, including the requirements to “sanitize” devices.
Finally, SAMHSA has not included in the Final Rule the changes set forth in the Coronavirus Aid, Relief and Economic Security Act (“CARES Act”) which, most notably for Part 2 purposes, sought to align Part 2 confidentiality rules with HIPAA regulations. SAMHSA indicated that a new rule will be issued in the near future to implement the CARES Act changes, which may further modify Part 2 consent requirements to align with HIPAA. The CARES Act requires such changes to be implemented by March 2021. We will continue to monitor any subsequent rulemaking and changes to the Part 2 regulations.
For a short and comprehensive summary of each regulation change, SAMHSA has published this Fact Sheet. The Final Rule was published as 85 Fed. Reg. 42986 (July 15, 2020).
Please visit our Healthcare Law Practice Area to learn more about the legal services we can provide in this area. If you have any questions or would like more information on the issues discussed in this communication, please contact any member of our Healthcare Law practice.
