On July 15, 2020, a final rule revising the federal regulations governing the Confidentiality of Substance Use Disorder Patient Records (also known as 42 C.F.R. Part 2 or Part 2) was published. The revised rule will implement many of the changes to the federal regulations proposed last year. The basic principle underlying these changes is to maintain privacy protections for individuals seeking treatment for substance use disorders (SUDs), while facilitating better coordination of care in response to the opioid epidemic. The Substance Abuse and Mental Health Services Administration (SAMHSA) also published an accompanying fact sheet with a user-friendly summary of the changes and the purposes behind them.

Of note, this revised rule does not include the anticipated changes to Part 2 under the regulations implementing the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which will further modify several of the amendments adopted in this final rule. The changes in the final rule will serve as interim and transitional standards, until regulations under the CARES Act are finalized.

Changes to Encourage Information Sharing for Care Coordination

For years, Part 2’s rigorous consent requirements have served as a barrier for substance use disorder treatment programs, as defined under the Part 2 regulations (Part 2 Programs), to share information, even in circumstances when patients wanted them to do so. Part 2 has required that a valid consent specify the name of the individual to whom a disclosure may be made, subject to certain exceptions such as disclosures to treating providers and third-party payers. Even if a SUD patient wished to authorize disclosure of her information to an organization, such as a local sober living program, Part 2 required that the authorization list the name of the individual receiving the patient’s information at the sober living facility.

Part 2 Programs have largely viewed this requirement as operationally impossible to implement and complained that it necessitates the total exclusion of SUD information from care coordination and benefits programs into which patients have affirmatively opted.. Although recent changes in 2017 relaxed Part 2’s consent requirements when patients authorize disclosures to treating providers, Part 2 has remained a significant barrier to information sharing in contexts beyond treatment. These most recent revisions to the rule now allow patients to consent to the disclosure of their information without naming a specific individual to receive this information on behalf of a given entity, allowing the written consent to identify “The name(s) of the individual(s) or the name(s) of the entity(-ies) to which a disclosure is to be made.”

The revised rule also includes several other noteworthy changes to encourage information sharing. To facilitate coordination of care activities by providers outside of a Part 2 Program (non-Part 2 Providers), SAMHSA revised the definition of “records” to clarify that entities and individuals who are not covered by Part 2 need only apply confidentiality protections to the specific Part 2 record they receive from a Part 2 Program. This creates a safe harbor for non-Part 2 Providers that segregate Part 2 records they receive, ensuring that such non-Part 2 Providers need not fear that their own records suddenly becomes subject to Part 2’s requirements. The revised rule also provides that information conveyed orally by a Part 2 Program to a non-Part 2 Provider for treatment purposes with patient consent “does not become a record subject to [Part 2] in the possession of the non-[P]art 2 provider merely because that information is reduced to writing by that non-[P]art 2 provider.”

Disclosures During Medical Emergencies Expanded

Prior to these revisions, Part 2 permitted disclosures to medical personnel without patient consent only to the extent necessary to meet a bona fide medical emergency in which the patient's prior informed consent cannot be obtained. The revised rule now also allows for disclosures to medical personnel without patient consent to the extent necessary to meet “a bona fide medical emergency in which a [P]art 2 program is closed and unable to provide services or obtain the prior written consent of the patient, during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time that the [P]art 2 program resumes operations.” SAMHSA expanded the information sharing permitted during emergencies because emergency situations often disrupt a patient’s access to their usual SUD treatment services—as the COVID-19 public health emergency has plainly illustrated—which can lead to patients seeking treatment with providers who do not have full access to their records. During such an emergency, adherence to normal policies and procedures for obtaining patient consent to share information for treatment purposes may not be feasible.

Disclosures for Payment and Health Care Operations

The revised rule also updates the regulation governing re-disclosures of SUD records by a contractor for the contractor’s payment and health care operations purposes. In 2018, Part 2 was revised to permit contractors that receive SUD records via patient consent for payment and/or health care operations purposes to re-disclose those records to subcontractors that carry out payment and/or health care operations functions for the contractor. At the time, Part 2 did not define “payment” and “health care operations” other than in the preamble to the 2018 rule (which excluded care coordination from the examples of payment and health care operations). The list of 18 examples is now expressly included in the regulation text itself and largely align with HIPAA’s definition of the terms “payment” and “health care operations,” including care coordination and case management services in the definition.

While these changes will be considered a step in the right direction by many, industry members will still be looking for the additional CARES Act changes to the Part 2 regulations and overall additional flexibilities which would align Part 2 more closely with HIPAA. Foley & Lardner will continue to monitor developments in this area.

The revisions to Part 2 are effective on August 15, 2020.