Rules on confidentiality of substance use disorder patient records recently changed

On January 3, 2018, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued a Final Rule which results in changes to the federal regulations governing substance use disorder patient records, or so-called “Part 2” records. This Final Rule follows a 2017 Final Rule that was the first major overhaul and modernization of the Part 2 requirements in 30 years.

According to SAMHSA, the Final Rule aims to better align the Part 2 regulations with advances in health care delivery while retaining important privacy protections for individuals seeking treatment for substance use disorders. The Final Rule also aims to better align Part 2 requirements with those of HIPAA.

Notable provisions in the Final Rule include:

• New, abbreviated option for giving notice of the prohibition on re-disclosure. The abbreviated notice reads “42 CFR part 2 prohibits unauthorized disclosure of these records.” As the revised notice has limited characters, SAMHSA believes that it can be more readily used with existing electronic health record systems. Organizations not wishing to use the abbreviated notice may still use the existing, longer notice.
• New requirements for a “lawful holder” of records to have a written contract in place with its contractors, subcontractors and legal representatives before disclosing patient identifying information for payment and health care operations. A lawful holder of patient identifying information is an individual or entity who has received such information as the result of a Part 2 compliant patient consent (e.g., a patient’s treatment provider or hospital emergency room).
• Permissible disclosures of patient identifying information without consent to certain contractors, subcontractors and legal representatives for the purpose of conducting a Medicare, Medicaid or CHIP audit or evaluation.

The Final Rule is effective February 2, 2018, with the exception of the new requirement for contracts between lawful holders and entities that receive patient identifying information for payment and health care operations. These contracts must be in place by February 2, 2020.