The Substance Abuse and Mental Health Services Administration (SAMHSA) released a final rule on January 2, 2018 (Final Rule) attempting to bridge the gap between the Health Insurance Portability and Accountability Act (HIPAA) and 42 CFR Part 2 (Part 2). Part 2 protects the confidentiality of patient alcohol and drug abuse records and applies to health care entities that receive federal assistance and provide substance abuse treatment. HIPAA generally protects the confidentiality of patient information and is typically less stringent than Part 2 requirements.

Effective February 2, 2018, the Final Rule, which was driven by the growth of electronic health records and integrated health care models, specifically addresses (1) the prohibition on re-disclosure notice by including an option for an abbreviated notice and (2) the circumstances under which lawful holders and their legal representatives may use and disclose patient identifying information for purposes of payment, health care operations and audits and evaluations.

• Abbreviated Notice on Re-Disclosure. 42 CFR § 2.32 requires any disclosure of Part 2 records made with the patient’s written consent to include a prohibition on re-disclosure. Previously, this required a lengthy written re-disclosure statement. Due to concerns about character limits in text fields within electronic health record systems and ongoing tension between the rigorous disclosure requirements of Part 2 and the broad range of permissible disclosures under HIPAA, the Final Rule provides an alternative written statement which is significantly shorter. Health care providers now have the option of providing either of the following written statements:

(1) This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see § 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65; or

(2) 42 CFR part 2 prohibits unauthorized disclosure of these records.

• Disclosures to Contractors, Subcontractors, or Legal Representatives for Payment and/or Health Care Operations. 42 CFR § 2.33 previously required a program covered under Part 2 to disclose records of a patient in accordance with the patient consent and to any person identified in the consent. The Final Rule amends 42 CFR § 2.33 to allow a lawful holder of patient identifying information for payment and/or health care operations activities to further disclose those records to its contractors, subcontractors, or legal representatives to carry out payment and/or health care operations on its behalf.

Lawful holders wishing to disclose this patient identifying information to contractors, subcontractors or legal representatives must:

(1) have in place a written contract with the recipient which provides that the recipient is fully bound by the provisions of Part 2 upon receipt of the patient identifying information;

(2) furnish to the recipient the re-disclosure notice required under 42 CFR § 2.32;

(3) require the recipient to implement appropriate safeguards to prevent unauthorized uses and disclosures; and

(4) require the recipient to report any unauthorized uses, disclosures or breaches of patient identifying information to the lawful holder.

As for what SAMSHA considers “payment and/or health care operations activities”, SAMSHA has included in the preamble to the Final Rule an illustrative list of 17 types of payment or health care operations activities. The list includes, among other activities: clinical professional support services, billing and claims management, patient safety activities, training activities, third party liability coverage, and accreditation, certification, licensing or credentialing activities.

Contracts between lawful holders and contractors, subcontractors and legal representatives must be in compliance with the Final Rule by February 2, 2020.

This Final Rule follows a January 18, 2017 final rule from SAMHSA that allowed patients to give general consents instead of requiring individual consents each time a record was shared; an overview of the 2017 final rule can be found here. That this is the second final rule to be issued in less than one year – the last amendment prior to that was in 1987 - indicates SAMSHA’s desire to modernize and clarify Part 2 requirements in light of advancements in the U.S. health care delivery system.

The Final Rule is a positive step in promoting more innovative models of health care delivery, including integrated and coordinated care, while trying to align Part 2 with the far more progressive and familiar HIPAA requirements. This shift should lead to improved compliance with Part 2, which was previously lacking. Clients who are affected by this rule should review their patient consent agreements to determine if the abbreviated re-disclosure is appropriate. In addition, clients should review existing relations with their downstream contractors and legal representatives who engage in payment and/or health care operations and, if required, enter into compliant contractual agreements as required by the Final Rule. 

The January 3, 2018 Federal Register publishing the Final Rule can be found here.