Updating Part 2: SAMHSA Issues another Final Rule
On January 3, 2018, the Substance Abuse and Mental Health Services Administration (SAMHSA) released a final rule governing the Confidentiality of Substance Use Disorder Patient Records (Part 2). This final rule addresses the following areas of the Part 2 regulations: prohibition on re-disclosure of Part 2 information, and circumstances and requirements under which a lawful holder may disclose Part 2 information. The final rule is effective on February 2, 2018.
Prohibition on re-disclosure of Part 2 Information
The final rule allows Part 2 information disclosed with a patient’s written consent to be accompanied by an abbreviated notice of the prohibition on re-disclosure: it reads “42 CFR part 2 prohibits unauthorized disclosure of these records.” SAMHSA noted that the abbreviated notice was necessary to comply with the limitations of text fields within electronic health record systems; a majority of which are limited to eighty (80) characters. Finally, due to the lack of consensus as to when the use of the abbreviated notice was appropriate, SAMHSA decided to allow the use of the abbreviated notice “in any instance in which a notice is required under the regulations.”
Disclosures Permitted with Written Consent
In its notice of proposed rulemaking, SAMHSA proposed to explicitly list specific types of payment and health care operation activities for which a lawful holder of Part 2 information is allowed to further disclose to its contractors, subcontractors, and legal representatives. The proposed rule included a list of seventeen (17) specific types of payment and health care operation activities. The final rule moves the list from the regulatory text to the preamble of the final rule. SAMHSA acknowledged that placing the list in the regulatory text not only narrowed the scope of permitted disclosures, but also limited the adaptability of the regulations in light of the “rapid changes occurring in the health care payment and delivery system.” SAMHSA stated its intent for the list to be illustrative, not an exhaustive list of the types of permitted payment and health care operation activities. Commenters questioned SAMHSA’s decision to specifically exclude care coordination and case management from the list, noting that the HIPAA Privacy Rule’s definition of “health care operations” includes care coordination and case management activities. In response, SAMHSA stated that while it has attempted to align Part 2 and HIPAA, care coordination and case management activities include substance use disorder diagnosis, treatment, or referral for treatment, which may have a negative impact on patient choice in disclosing information to health care providers with whom patients have direct contact.
Contract Provisions for Disclosures
The final rule requires lawful holders utilizing contractors or subcontractors to assist with payment and health care operations requiring the use of Part 2 information to include specific contract provisions requiring contractors and subcontractors to comply with the Part 2 regulations. While, SAMHSA did not provide or specify exact contractual language, it stated that a compliant contractual provision should (1) include a purpose section, stating that the purpose of the contract was for payment or health care operation activities, and (2) specifically mention the Part 2 regulations. Commenters asked whether HIPAA compliant business associate agreements satisfy the Part 2 contractual provision requirement because they already require the business associate to comply with all applicable federal and state laws. SAMHSA stated that it attempted to align Part 2 and HIPAA, “it [was] not SAMHSA’s intent to apply part 2 to contractors and subcontractors in a manner similar to what was accomplished under the HIPAA Privacy and Security Rules for Business Associates.” To help mitigate the administrative burden of amending numerous contracts, the final rule established a two (2) year grace period for lawful holders to bring their contractor and subcontractor contracts into compliance with the final rule.
Audit and Evaluation
The final rule allows federal, state, and local governments to: (1) have access to a Part 2 program’s and lawful holder’s Part 2 records and information, and (2) disclose Part 2 information to contractors, subcontractors, or legal representatives conducting Medicare, Medicaid, or CHIP audit or evaluation activities, including an administrative remedy or civil investigation.
Takeaways
Overall this final rule was favorable to Part 2 programs and lawful holders of Part 2 information. While SAMHSA has continued to resist fully aligning the Part 2 regulations with HIPAA, the abbreviated notice provision, broad scope of payment and health care operation activities, and the addition of audit and evaluation activities should ease the burden of Part 2 compliance. Finally, Part 2 programs and lawful holders should begin to re-evaluate their contracts with contractors, subcontractors, and other legal representatives requiring access to Part 2 information and begin planning on amending these agreements before the two (2) year grace period sunsets on February 2, 2020.