Earlier this month, the Substance Abuse and Mental Health Services Administration (SAMHSA) within the U.S. Department of Health and Human Services (HHS) issued a final rule implementing updates to 42 C.F.R Part 2 (Part 2), the federal regulations governing the privacy of substance use disorder (SUD) treatment records. These privacy regulations, which create a number of challenges for the federally-assisted health care programs to which they apply, have historically been considerably stricter than HIPAA, although recent updates reflect a general move toward aligning Part 2 more closely with HIPAA. 

The regulatory updates from this month include the following changes, among others, as further described by SAMHSA:

• To facilitate coordination of care, the regulations now clarify that treatment records created by non-Part 2 providers based on their own patient encounters are not covered by Part 2 unless SUD records previously received from a Part 2 program are incorporated into such records (and providers can use segmentation to avoid mixing of records)
• Part 2 employees may “sanitize” personal devices when they receive incidental messages from patients by deleting such messages
• A SUD patient may consent to disclosure of SUD patient records to an entity without naming a specific person as the recipient for the disclosure
• SAMHSA has created new allowances with respect to querying central registries to better prevent duplicative enrollments in SUD care, and with respect to enrollment in state prescription drug monitoring programs to better prevent duplicative prescriptions and adverse drug events
• Disclosures for the purpose of “payment” and “health care operations” are permitted with written consent, and the illustrative list of 18 activities that constitute payment and health care operations from the commentary has now been added to the regulations
• Declared emergencies resulting from natural disasters that disrupt treatment facilities are considered a “bona fide medical emergency” for purposes of disclosing SUD records without patient consent under Part 2
• SAMHSA has clarified specific situations that fall within the scope of permissible disclosures for audit and/or program evaluation purposes

SAMHSA is releasing this Part 2 regulatory update ahead of further changes mandated by the recently enacted CARES Act, which are expected by March 27, 2021. As mentioned in a prior update, Section 3221 of the CARES Act makes a number of key changes to Part 2 to increase flexibility and consistency with HIPAA requirements. This includes, among other things, a streamlined patient consent provision, which allows multiple future uses and disclosures of patient information to multiple parties, pursuant to a single consent, for purposes of treatment, payment, and health care operations as defined under HIPAA. This change alone will substantially ease patient information-related regulatory burdens for providers subject to Part 2. 

Stay tuned for further information regarding these forthcoming regulations once they become available.