On January 13, 2017, SAMHSA  issued a Final Rule updating the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (42 C.F.R. Part 2). SAMHSA also issued a Supplemental Proposed Rule requesting comments on additional proposed changes to these regulations. The Final Rule is effective and comments on the Supplemental Proposed Rule are due on February 17, 2017.

Final Rule

The last substantive changes to 42 C.F.R. Part 2 (“Part 2”) were in 1987.  The updates in the Final Rule are intended to:  (1) address new integrated health care models; (2) facilitate information exchange within new health care models; and (3) make the regulations more straightforward and less burdensome.

Below are some of the substantive changes to the regulations:

• Recipients of substance use disorder patient records (“Records”). Part 2 will continue to apply to any federally assisted program that provides or holds itself out as providing diagnosis, treatment, or referral for treatment for substance use disorder, including an identified unit or medical personnel or other staff within a general medical facility. The Final Rule extends Part 2 to individuals or entities who obtained Records pursuant to a Part 2-compliant patient consent.

• Patient Consent to Disclosure. Under the Final Rule records may be disclosed to health care provider entities, third party payers, and health information exchanges and research institutions in certain instances, in addition to named individuals. 

• General Designation Disclosures. Patients who have agreed to general designation disclosures have the right to receive a list of entities to whom their information has been disclosed, if requested. Entities disclosing Part 2 information pursuant to a general designation on a patient’s consent form (e.g., accountable care organizations, health information exchanges) must have the ability to comply with the “List of Disclosures” provision and must notify patients of this right in the consent form authorizing the disclosure.

• Re-Disclosure Prohibition.The Final Rule clarifies the prohibition on re-disclosure of a patient’s information applies only to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, such as indicated through standard medical codes, descriptive language, or both.

• Qualified Service Organizations.The Final Rule expands the definition of a qualified service organization, which can receive information from a Part 2 provider without express patient consent, to include entities that provide population health management services, but not care coordination services, to a Part 2 program.

• Researchers.The Final Rule allows disclosure of Records to qualified personnel for purposes of conducting scientific research, provided the researcher meets certain regulatory requirements related to other existing protections for human research (e.g., the researcher is subject to patient authorization and/or privacy protections under the HIPAA Privacy Rule or the Common Rule).

• Electronic Records Requirements.  The Final rule modernizes Part 2 to include requirements for both paper and electronic records. For example, Part 2 programs and other lawful holders of patient identifying information must implement formal policies and procedures for the security of both paper and electronic records, and utilize encryption for electronic records transfer.

Supplemental Proposed Rule

In the Supplemental Proposed Rule, SAMHSA seeks public comment on its proposals to:

• Explicitly list and limit specific types of activities for which any lawful holder of Records may be allowed to further disclose the minimal information necessary for specific payment and health care operations activities;

• Allow an abbreviated re-disclosure notice in certain circumstances; and

• Address disclosures by contractors, subcontractors, and legal representatives for purposes of audit and evaluation activities, which could include  quality improvement activities, and reimbursement and financing efforts by entities other than CMS-regulated payers.