January 5, 2018 – The Substance Abuse and Mental Health Services Administration (“SAMHSA”) issued a Final Rule on January 3, 2018, implementing new changes to the federal rules governing confidentiality and disclosures of substance use disorder patient records, known as 42 CFR Part 2 or “Part 2.”
While the new Final Rule maintains Part 2’s core protections, including consent requirements, it expands the ways in which patients’ protected substance use disorder information may be shared.
- Disclosures with Patient Consent: Under the new Final Rule, when a patient consents to their substance use disorder information being disclosed for payment or health care operations purposes, the recipient listed on the consent form is allowed to share that substance use disorder information with their contractors, sub-contractors, and legal representatives as necessary to carry out the payment or health care operations.
- Audit and Evaluation: Previously, only Part 2 programs (generally specialty substance use disorder treatment programs) were permitted to disclose protected substance use disorder information without patient consent for audits and evaluations. Under the new Final Rule, other individuals and entities which have lawfully received Part 2-protected information (known as “lawful holders”) may also disclose substance use disorder information for the purpose of certain types of audits and evaluations. In addition, the new Final Rule allows information disclosed under Part 2’s audit and evaluation exception to be shared with auditors’ and evaluators’ contractors, sub-contractors, and legal representatives as needed to carry out the audit or evaluation.
The new Final Rule also allows for an abbreviated notice of the prohibition on redisclosure.
The new Final Rule will go into effect February 2, 2018. The Legal Action Center (“LAC”) continues to analyze the Final Rule and will release additional information soon. The new Final Rule adopts changes proposed by SAMHSA in a January 18, 2017 Supplemental Notice of Proposed Rulemaking. This week’s Final Rule follows another change to the regulations last January, which made more extensive changes to 42 CFR Part 2.
LAC welcomes the Final Rule’s recognition of the continued importance of the protections at the heart of 42 CFR Part 2. LAC strongly believes that Part 2’s protections remain as critical today as they were when enacted 40 years ago. We are pleased that Part 2’s core consent protections remain intact in the new Final Rule, but we remain deeply concerned that loosening restrictions around the sharing of health information without patients’ knowledge to other unknown parties may deter people from seeking treatment, and harm patients in treatment. In the midst of the deadly opioid epidemic and in the face of increased data breaches of health information, it is more important than ever to recognize our current laws’ protections for patient privacy as a critical guarantee to encourage individuals to enter treatment. LAC urges SAMHSA to release sub-regulatory guidance clarifying that the provisions of the new Final Rule may not be used to limit patients’ rights or opportunities in any way.
The forthcoming revision of our landmark book, Confidentiality and Communication: A Guide to Federal Drug and Alcohol Confidentiality Law and HIPAA, will also incorporate our analysis of these changes. Sign up for our mailing list to receive updates on 42 CFR Part 2, including updates on the book and upcoming trainings on 42 CFR Part 2. Substance use disorder treatment programs in states that subscribe to the Legal Action Center’s “Actionline” can also call with questions regarding 42 CFR Part 2 and speak with a Legal Action Center attorney.
Media Contact: Abigail Woodworth
Email: [email protected]