On July 15, 2020, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued its final rule finalizing significant revisions to the Confidentiality of Substance Use Disorder Patient Records (Part 2) regulations. Notably the final rule continued SAMHSA’s push to facilitate and enhance coordination of care for substance use disorders (SUD) while still maintaining Part 2 confidentiality protections. Furthermore, the final rule is a stepping stone for even further changes that the Department of Health and Human Services (HHS) will make by promulgating regulations pursuant to the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). The CARES Act seeks in part to bring Part 2 more in alignment with the Health Insurance Portability and Accountability Act (HIPAA). Until then, effective August 14, 2020, key changes will be made to Part 2 that will have implications for Part 2 programs as well as non-Part 2 providers. Some of these key changes are discussed below.
Applicability and re-disclosure
In the August 26, 2019, Notice of Proposed Rulemaking (NPRM), SAMHSA sought to clarify the confidentiality and restrictions on re-disclosure of SUD-related information collected by Part 2 programs and non-Part 2 providers. Specifically, SAMHSA noted that a non-Part 2 provider’s inclusion of SUD information in such provider’s own clinical encounter records does not subject that record to Part 2, even in cases where the SUD information may have originated from a discussion with a Part 2 provider or from the non-Part 2 provider’s review of the Part 2 record. SAMHSA finalized this clarification based on the NPRM. In order to ensure that a non-Part 2 provider’s record does not become subject to Part 2, SAMHSA also continued to support, as it previously did in the NPRM, that non-Part 2 providers “segregate” or “segment” Part 2 records it received from a Part 2 program or another lawful holder of Part 2 records in order to differentiate information subject to Part 2. While many stakeholders in their public comments supported the idea of being able to segregate or segment Part 2 records, they noted that SAMHSA needed to provide more guidance on how to properly segregate or segment Part 2 records to address technology capabilities and operational expenses concerns. SAMHSA did not provide any additional guidance but noted that it will continue to work with the Office of National Coordinator for Health Information Technology on further support and implementing health IT policies that are consistent with Part 2.
Consent requirements
In the NPRM, SAMHSA proposed to allow patients to more easily authorize the disclosure of their Part 2 record to entities that were non-treating providers. This was in response to many patients being frustrated that under the revised 2017 Part 2 regulations they could not share their Part 2 records with entities for critical support services and benefits (e.g., Social Security benefits) unless they identified a specific individual to receive the Part 2 record information. SAMHSA finalized its proposal that patients could share its Part 2 record information to an entity without having to identify an individual as long as the recipient entity is not an entity that facilitates the exchange of health information or a research institution in order to ensure that only entities with the need to know the protected information from Part 2 records receive it.
Disclosures permitted with written consent
SAMHSA finalized its rule providing that payment and health care operations activities (e.g., billing, underwriting, third-party liability coverage, etc.) that are permitted to be disclosed by lawful holders to contractors, subcontractors, and legal representatives be listed in the Part 2 regulations. This listing of payment and health care operations activities in the actual Part 2 regulations was done by SAMHSA after SAMHSA noted in the NPRM that stakeholders had expressed confusion on whether information from Part 2 records could be disclosed for certain activities if not explicitly identified in the regulatory text.
The most drastic change from the NPRM to the final rule came from the final rule stating that care coordination and case management are now considered permissible health care operations activities for which a lawful holder can disclose Part 2 records to contractors, subcontractors, and legal representatives. Previously, in the 2018 final rule as well as the 2019 NPRM, SAMHSA emphasized that disclosures for health care operations under Part 2 are not intended to be like HIPAA. Subsequently, activities, such as care coordination and case management, that relate to a patient’s diagnosis, treatment, or referral for treatment were not permissible for disclosure by a lawful holder under Part 2. To support SAMHSA’s change in its position on the permissibility of disclosure by a lawful holder for care coordination and case management purposes, even without notice in the NPRM of such activities inclusion, SAMHSA noted it already had significant support from stakeholders about the importance of being able to disclose Part 2 records for case management and care coordination purposes. Additionally, SAMHSA determined that the addition of case management and care coordination purposes for disclosures would be acceptable due to the forthcoming significant Part 2 revisions pursuant to the CARES Act.