On January 3, 2018, the United States Department of Health and Human Services (“HHS”) Substance Abuse and Mental Health Services Administration (“SAMHSA”) issued final regulations (“Final Rule“)[i] intended to update and modernize the Confidentiality of Substance Use Disorder Patient Records regulations at Title 42 of the Code of Federal Regulations, Part 2 (“Part 2“).[ii] The Final Rule builds upon the previous regulations issued by SAMHSA in January 2017.[iii] The Final Rule applies to Part 2 programs and other lawful holders of Part 2 information. The Final Rule provides:
- The option for Part 2 programs and lawful holders to use an abbreviated notice of the re-disclosure prohibition when disclosing Part 2 information;
- The ability of lawful holders to disclose Part 2 information to contractors, subcontractors and legal representatives (“contractors”) for payment and health care operations activities without additional patient consent, if certain conditions are met; and
- The ability of lawful holders to disclose Part 2 information for Medicaid, Medicare or Children’s Health Insurance Program (“CHIP”) audit or evaluation activities if certain conditions are met.
The effective date of the Final Rule is February 2, 2018.
- After this date, Part 2 programs and lawful holders may start using the abbreviated notice. Lawful holders may start disclosing Part 2 information to contractors for payment and health care operations under certain circumstances.
- By February 2, 2020, lawful holders must ensure that their agreements with contractors are in compliance with the Final Rule.
Through the Final Rule, SAMHSA has attempted to further align Part 2 with HIPAA, to the extent feasible, given that their underlying statutes and regulations are separate and distinct. Part 2 provides more stringent federal protections for substance use disorder information than HIPAA does as to protected health information. Ultimately, Part 2 seeks to protect individuals with substance use disorders who could be subject to discrimination and legal consequences in the event that their information is improperly used or disclosed. While the Final Rule and the previous regulations issued by SAMHSA make some progress toward reconciling the two sets of regulations, it is expected the industry will continue to experience difficulty in operationalizing the remaining differences.
Discussion of the Final Rule’s Changes to Part 2
Below is an overview of the Final Rule’s changes to Part 2. It is important to keep in mind that these changes do not affect disclosures by Part 2 programs to Qualified Service Organizations (“QSOs”). A QSO is a contracted entity that provides services to a Part 2 program pursuant to Qualified Service Organization Agreement. The Final Rule’s changes likewise do not affect the already permissible uses and disclosures within a Part 2 program or between a Part 2 program and an entity that has direct administrative control over the Part 2 program (such as a parent organization).
Prohibition on Re-Disclosure Notice (§ 2.32). Part 2 requires that a notice prohibiting re-disclosure accompany disclosures of Part 2 information. Under the Final Rule, SAMHSA provided an abbreviated notice option that is just 80 characters long to fit in standard free-text space within health care electronic systems. The abbreviated notice in the Final Rule is significantly shorter than the prior required notice (which still remains an option) and simply reads “Federal law/42 CFR Part 2 prohibits unauthorized disclosure of these records.”
Disclosures Permitted with Written Consent (§ 2.33(b)). Part 2 requires written patient consent prior to the disclosure of any Part 2 information, with few exceptions. Under the Final Rule, if a patient consents to a disclosure of their Part 2 information for payment and/or health care operations activities, the lawful holder who receives such information may now further disclose those records to its contractors as necessary to carry out payment and/or health care operations purposes on behalf of such lawful holder but may not do so for treatment purposes. In this context, treatment means diagnosis, treatment or referral for treatment, care coordination or case management. SAMSHA explained that it “believes it is important to maintain patient choice in disclosing health information to health care providers with whom patients have direct contact.”[iv] SAMSHA provided a list of 17 specific types of payment and health care operations activities as illustrative examples; however, the list is not exhaustive.
Previously, lawful holders, such as other treating providers or HIEs, struggled with whether they had the ability to further disclose Part 2 information to their contractors. Now they may do so for limited purposes.
Contract Provisions for Disclosures (§ 2.33(c)). The Final Rule requires a lawful holder, who engages a contractor to carry out payment and or health care operations activities, to have in place a written contract or comparable legal instrument specifically requiring the contractor to comply with Part 2. The lawful holders must require recipients of the Part 2 information to implement appropriate safeguards to prevent unauthorized uses and disclosures and to report any unauthorized uses, disclosures or breaches of Part 2 information to the lawful holder. SAMHSA did not specify the use of particular contract language to meet this requirement but did state that “referencing Part 2 in contracts will help to underscore the importance of compliance with Part 2 provisions.”[v] This is taken to mean that simple “compliance with law” language in existing agreements is likely insufficient for Part 2 compliance. We anticipate that lawful holders who are subject to HIPAA will incorporate a Part 2 provision into their standard business associate agreements.
Audit and evaluation (§ 2.53). Under the Final Rule, a lawful holder may now disclose Part 2 information to its contractors if the disclosure is for “a Medicare, Medicaid or CHIP audit or evaluation, including a civil investigation or administrative remedy.”[vi] Business associates under HIPAA have typically been permitted to make these types of disclosures.
Practical Takeaways
In response to the Final Rule, by February 2, 2018, health care organizations should:
- Re-affirm whether they are a Part 2 program, QSO or other lawful holder of Part 2 information;
- Review and revise policies and procedures as needed to adopt the abbreviated re-disclosure notice to accompany electronic and paper disclosures of Part 2 information;
- Review and revise patient consent forms as needed to allow for the disclosure of Part 2 information for payment and/or health care operations to contractors to ensure the “purpose” section of the consent form is consistent with the purpose of the disclosure;
- Review and revise agreements as needed between lawful holders and contractors, if the contractor will receiving and disclosing Part 2 information for payment and health care operations, to ensure the contractor is required to comply with Part 2. (The compliance date for this requirement is February 2, 2020); and
- Participate in or monitor the outcome from the January 31, 2018 stakeholder meeting to be held by HHS regarding the effects of Part 2 on patient care, health outcomes and patient privacy.
If you have questions or would like additional information about Part 2 or the recent changes to Part 2, please contact:
- Charise Frazier at (317) 977-1406 or cfrazier@wp.hallrender.com;
- Elizabeth Callahan-Morris at (248) 457-7854 or ecallahan@wp.hallrender.com;
- Patricia Connelly at (317) 429-3654 or pconnelly@wp.hallrender.com; or
- Your regular Hall Render attorney.
[i] Confidentiality of Substance Use Disorder Records, 83 Fed. Reg. 239, 244 (Jan. 3, 2018) (to be codified at 42 C.F.R. pt. 2).
[ii] Confidentiality of Substance Use Disorder Patient Records 42 C.F.R. pt. 2 (2018).
[iii] Confidentiality of Substance Use Disorder Patient Records, 82 Fed. Reg. 6052 (Jan. 18, 2017).
[iv] Confidentiality of Substance Use Disorder Records, 83 Fed. Reg. 239, 243 (Jan. 3, 2018) (to be codified at 42 C.F.R. pt. 2).
[v] Id. at 244.
[vi] Id. at 246.
