SAMHSA Amends Confidentiality of Substance Use Disorder Patient Records Regulations

On January 18, the Substance Abuse and Mental Health Services Administration ("SAMHSA"), an agency of the United States Department of Health and Human Services, issued a Final Rule amending the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (also known as 42 CFR Part 2, or "Part 2 Regulations," or "Part 2").  The Final Rule is intended to facilitate health information exchange while continuing to protect the privacy of patients seeking treatment for substance use disorders.  The Final Rule was to go into effect on February 17, but a Trump administration regulatory freeze has delayed the effective date until at least March 21. 

Part 2 generally prohibits the disclosure of substance use disorder diagnosis, referral, or treatment information outside of a Part 2 program without the patient's consent.  Part 2 programs include the following, so long as they are federally assisted: 

• Individuals and entities (other than general medical facilities) that hold themselves out as providing, and provide, substance use disorder diagnosis, treatment, or referrals for treatment;

• Identified units or programs within general medical facilities that hold themselves out as providing, and provide, substance use disorder diagnosis, treatment, or referrals for treatment; and

• Medical personnel and other staff in general medical facilities whose primary function is the provision of substance use disorder diagnosis, treatment, or referrals for treatment and who are identified as such providers. 

Under Part 2's broad definition of "federally assisted," the only programs that would not be considered "federally assisted" are those that are for-profit and which only accept the privately insured or individuals who pay out of pocket for all treatment received. 

Without first obtaining the patient's consent, Part 2 programs may not share information that would identify a patient as having a substance use disorder with practitioners that are not part of the particular Part 2 program at issue, including practitioners who also provide treatment to the patient.  The Final Rule retains the general prohibition against disclosure outside the Part 2 program without the patient's consent, but makes the following changes, among others, intended to facilitate health information exchange while maintaining safeguards to protect the privacy of health information:

• Consent Requirements.  Patients may consent to the disclosure of their Part 2 program information through a general designation, such as (a) "to my past, present and future treatment providers," thus eliminating the requirement that the patient sign a new consent for each provider; (b) third party payors; and (c) health information exchanges, which may then further disclose to authorized individuals and entities who have a treating relationship with the patient.  The consent also can be drafted to authorize disclosure of "all of my substance use disorder information," as long as more specific options are made available.

• Qualified Service Organizations.  The Final Rule continues to permit a Part 2 program to disclose patient identifying information to Qualified Service Organizations ("QSO") with which the Part 2 program contracts to provide certain services, such as data processing, billing and collections, dosage preparation, legal, accounting, or medical staffing.  The Final Rule updates the definition of QSO to include an organization that provides population health management services to the Part 2 program.  However, permitted disclosures are limited to the office or unit responsible for population health management in the organization, and not the entire organization or its participants. 

• Prohibition on Re-disclosure.  Each disclosure with a patient’s written consent must include notice to the recipient that further disclosure of information that would identify a patient as having been diagnosed, treated, or referred for treatment for a substance use disorder is prohibited unless such re-disclosure is affirmatively authorized by the patient.  The disclosure also must make clear that the federal rules restrict any use of the information to criminally investigate or prosecute any patient with a substance use disorder, except as provided in section 2.12(c)(5) (crimes on the premises) and section 2.65 (court orders).

• Disclosure Tracking.  Upon written request of a patient, entities that re-disclose Part 2 information pursuant to a general designation (but not to a specifically named individual or entity) must, within 30 days, provide to patients who have consented to such disclosure a list of entities to which their information has been disclosed within the past two years.  The list of disclosures also must include the date of the disclosure and a brief description of the patient identifying information disclosed.

• Security Policies.  Part 2 programs and other lawful holders of Part 2 program patient information must have in place policies to reasonably protect against unauthorized uses and disclosures of the information, as well as to protect against reasonably anticipated threats or hazards to the security of the information.  The policies must address both paper and electronic records, and identify how to securely create, maintain, transfer, remove, and destroy such records, as well as how to de-identify patient identifying information in a manner that creates a very low risk of re-identification.

Substance use disorder treatment providers should take the opportunity offered by the federal government's regulatory freeze to ensure their policies and procedures on patient privacy, consent documents, and re-disclosure statements are in compliance with the new requirements before they become effective.