The Revised Rule on the Confidentiality of Substance Use Disorder Records (For Now)

In July, the Substance Abuse and Mental Health Services Administration (“SAMHSA”) published an update to 42 CFR Part 2, better known simply as “Part 2.” This rule, as part of the “Regulatory Sprint to Coordinated Care,” finalizes certain changes proposed last year. These changes should not be overlooked by the health care industry at large, as many of them not only affect Part 2 programs, but providers who receive Part 2-protected records.

SAMHSA spelled out two objectives in its most recent update to Part 2. First, it recognized that the health care landscape has dramatically changed since the law was passed in the 1970s through the use of technology, interoperability, and patient privacy. Next, it highlighted the opioid epidemic that has swept the country over the last several years. This context provides helpful insight into why SAMHSA chose the sections of Part 2 to update.

The following provides a summary of the major changes or clarifications contained in the new rule.

• SAMHSA made it explicitly clear that non-Part 2 providers in possession of substance use disorder information does not necessarily mean the record is subject to Part 2. Part 2 records sent to non-Part 2 providers (such as a primary care provider) can be segregated from the patient’s general medical record so that the general medical record is not subject to Part 2. Furthermore, information told to non-Part 2 providers—either from a Part 2 program or from a substance use disorder patient (which is reduced to writing)—does not make the non-Part 2 provider’s record subject to Part 2. While this is not a change to the rule, it is helpful clarification on SAMHSA’s position regarding such records.
• Part 2 already permitted recipients to use Part 2 records for payment and health care operations so long as such uses are included in the patient’s consent. Those concepts had been left undefined in prior rulemaking, so the final rule provides a laundry list of potential uses that would be permissible under Part 2. Such disclosures include claims management, patient safety activities, training, business management, and customer service, among many others.
• The final rule simplified the consent form requirements, and permits a broad use of general consents. Previously, the rule had limited general consents to a provider with a treating relationship with the patient or payors. Now, the rule permits general consents to any person or entity (though there are special requirements for Health Information Exchanges and research institutions).
• There are several additional updates and clarifications including those related to the prevention of multiple enrollments, complying with state Prescription Drug Monitoring Program laws, research uses, audits, and court-related updates.

However, this final rule is not the last we will see on Part 2 updates. The statutory basis of Part 2 was revised as a part of the Coronavirus Aid, Relief, and Economic Security Act (the “CARES Act”; Pub. L. 116-136) (article available here). In the commentary to this rule, SAMHSA acknowledged the statutory update and its requirement that U.S. Department of Health and Human Services (“HHS”) publish rules updating Part 2. It signaled HHS’s intention to publish a new notice of proposed rulemaking in the future. SAMHSA stated, however, that the amendments included in this rule will serve as transitional standards as Part 2 will more closely align with HIPAA in the future.