On July 15, 2020, the Substance Abuse and Mental Health Services Administration (SAMHSA) published a final rule that, for the third time in as many years, significantly amended its regulations on the confidentiality of substance use disorder (SUD) patient records. SAMHSA is the agency within the U.S. Department of Health and Human Services that regulates alcohol and substance abuse treatment programs – so-called "Part 2 Programs." These confidentiality regulations, usually referred to as "42 CFR Part 2" (after the part of the Code of Federal Regulations where they are codified), had already been substantially revised by SAMHSA in 2017 and 2018. The three sets of regulatory changes reflect the agency's ongoing efforts to align the 42 CFR Part 2 requirements more closely with the HIPAA Privacy Rule1 and to facilitate coordinated treatment of SUDs by Part 2 Programs and non-Part 2 health care providers, while still preserving core confidentiality protections.
In addition to the three recent sets of regulatory amendments, the CARES Act2 passed earlier this year amended the federal law that governs the confidentiality of substance abuse treatment records.3 (The regulations at 42 CFR Part 2 were issued under the authority of this statute.) SAMHSA is required to issue new regulations to implement the CARES Act changes, but these new rules will be effective no earlier than March 27, 2021. The CARES Act regulations are expected to align the 42 CFR Part 2 rules even more closely with the regulations relating to the use and disclosure of "protected health information" under the HIPAA Privacy Rule.
The July 15, 2020 final rule (the 2020 Final Rule) went into effect on August 14, 2020. The most important changes included in the 2020 Final Rule are summarized in this information memo.
"Records" Subject to 42 CFR Part 2
SAMHSA's confidentiality rules strictly limit the disclosure and use of substance use disorder records, so the precise scope of the term “records” is very important. Generally, covered records are defined very broadly include “any information, whether recorded or not, created by, received, or acquired by a Part 2 Program (that is, a substance use disorder treatment program) relating to a patient.” The 2020 Final Rule, however, somewhat limits the scope of the Part 2 restrictions, in two ways:
First, the 2020 Final Rule amends the definition of “records” in 42 CFR Part 2 to specifically exclude information conveyed orally by a Part 2 Program to a non-Part 2 health care provider (for example, the patient’s primary care physician) for treatment purposes, with the consent of the patient. The exclusion applies even if the oral information is reduced to writing by the non-Part 2 provider.
Second, the 2020 Final Rule states that treatment records created by a non-Part 2 provider based on their own patient encounters are exempted from Part 2, even if the provider had received a treatment record from a Part 2 Program, unless as long as the covered Part 2 record is not incorporated into the non-Part 2 records.
In the Preamble to the 2020 Final Rule, SAMSHA summarizes these two changes as follows:
[T]he intent is to allow the Part 2 Program to make a disclosure, with the patient’s consent, to the recipient non-Part 2 provider. In turn, the non-Part 2 provider can then carry out her own encounter with the patient, and create her own patient record, which will not fall under the coverage of Part 2.
In short, this change is intended to assure non-Part 2 providers (including primary care physicians) that records of their own patient encounters will not become subject to the strict Part 2 requirements merely because they receive a treatment record from a Part 2 Program. The overall intent is to facilitate coordination of care activities between Part 2 Programs and other care providers.
Example
A substance use disorder treatment facility discloses a treatment record to the patient's primary care physician, with the patient's consent. If the primary care physician keeps records of her own encounters with the patient, those records are not subject to 42 CFR Part 2, unless the primary care physician incorporates the received Part 2 record into her own records.
Note: In connection with these changes, SAMHSA also revised the standard “Prohibition on Redisclosure” notice that Part 2 Programs must provide when they disclose covered patient records, to state more clearly that only the Part 2 record itself is subject to the redisclosure prohibition.
Patient Consents
The 2020 Final Rule also revises some requirements of patient consents, by allowing patients to consent to disclosure of their Part 2 information to entities (health care institutions, governmental agencies, etc.) without naming the specific individual who will receive the information. The new rule allows patients to consent to disclosure of their information to a wider range of entities with whom they do not have a treatment relationship without having to name a specific individual to receive the information.
Example
A SUD treatment facility can disclose a patient's treatment record, with the patient's consent, to a non-medical provider (such as a halfway house) simply by entering the entity name in the consent form, without naming a specific individual who will receive the information.
Previously, a patient's consent to disclose a 42 CFR Part 2 record typically had to name a specific individual at an entity to which records were disclosed, if the patient did not have a treatment relationship with that entity.
Part 2 Information on Personal Devices
The 2020 Final Rule includes guidance on how Part 2 Program staff, including employees, volunteers, and trainees, should handle communications when using personal devices or accounts. If patient contact is made through a staff member’s personal email or cell phone account, not used in the regular course of business for the Part 2 Program, the staff member should immediately delete the information from his or her personal account and only respond via an authorized channel provided by the Part 2 Program, unless responding directly from the personal account is required to protect the best interests of the patient. Once immediate needs are addressed, the messages should be forwarded to an authorized channel (if containing patient identifying information) and deleted from the personal device. Eliminating the use of personal accounts will assist Part 2 Programs with record-keeping responsibilities, including the requirements to “sanitize” devices.
Clarifications as to Disclosures for Health Care Treatment, Payment or Operations
Previously, if a patient provided written consent to disclose their SUD records to a lawful holder for payment or healthcare operations purposes, the lawful holder could then redisclose the minimum necessary portion of these records to their contractors, subcontractors or legal representatives to fulfill those purposes without additional patient consent. The preamble to the 2018 Final Rule included an illustrative list of examples of “payment and healthcare operations” functions. However, the 2018 Final Rule prohibited redisclosures of SUD records by lawful holders to subcontractors, contractors and legal representatives for treatment purposes, so as to permit patients to determine where their personal information would be redisclosed for treatment purposes. Care coordination and case management were specifically excluded from the list of permissible payment and healthcare operations activities.
SAMHSA has reversed this decision in the 2020 Final Rule: care coordination and case management activities are specifically included as purposes for which a lawful holder, who has received Part 2 information with the patient’s consent, may make further disclosures as necessary to its contractors, subcontractors and legal representatives to support its payment and health care operations. Furthermore, the permissible "payment and health care operations" functions are now expressly stated in the regulations themselves.
It continues to be the rule that Part 2 information disclosed with the patient's consent for treatment purposes may not be further disclosed to a lawful holder’s contractors, subcontractors or legal representatives without the patient’s express consent.
Other Changes
Medical Emergencies: The Final Rule expands the list of medical emergencies, during which disclosures without patient consent are permitted, to include state or federally declared natural disasters or emergencies resulting from natural disasters (for example, hurricanes).
Research Disclosures: The rules that govern disclosures of SUD treatment records for research purposes have been expanded to permit disclosures by HIPAA covered entities to individuals and organizations that are neither HIPAA covered entities nor subject to the federal Common Rule.4 Such disclosures, however, must be made in accordance with the HIPAA Privacy Rule.
Audits and Evaluations: In the Final Rule, SAMHSA expanded and clarified which entities can conduct audits and evaluations and the activities that are permitted to be undertaken when an audit or evaluation takes place. Specifically, the 2020 Final Rule states that audits and evaluations can include reviews of the appropriateness of medical care, medical necessity and utilization review; and that entities conducting audits or evaluations in accordance with the new rule may include accreditation or similar organizations involved in quality assurance.
The changes made by the 2020 Final Rule are largely designed to provide more flexibility to substance abuse treatment programs and other health care providers with whom they deal, but 42 CFR Part 2 compliance remains a formidable task. Furthermore, as a result of the changes in the 2020 Final Rule, Part 2 Programs may have to update their consent forms, patient notices and redisclosure notices to comply with the 2020 Final Rule.
In addition, the CARES Act changes to 42 CFR Part 2 may be effective as soon as March 2021. We will summarize these new changes in a future information memo.
If you have any questions regarding the 2020 Final Rule or the 42 CFR Part 2 confidentiality requirements, please contact Rob Patterson or the attorney in the firm with whom you are regularly in contact.
On July 15, 2020, the Substance Abuse and Mental Health Services Administration (SAMHSA) published a final rule that, for the third time in as many years, significantly amended its regulations on the confidentiality of substance use disorder (SUD) patient records. SAMHSA is the agency within the U.S. Department of Health and Human Services that regulates alcohol and substance abuse treatment programs – so-called "Part 2 Programs." These confidentiality regulations, usually referred to as "42 CFR Part 2" (after the part of the Code of Federal Regulations where they are codified), had already been substantially revised by SAMHSA in 2017 and 2018. The three sets of regulatory changes reflect the agency's ongoing efforts to align the 42 CFR Part 2 requirements more closely with the HIPAA Privacy Rule1 and to facilitate coordinated treatment of SUDs by Part 2 Programs and non-Part 2 health care providers, while still preserving core confidentiality protections.
In addition to the three recent sets of regulatory amendments, the CARES Act2 passed earlier this year amended the federal law that governs the confidentiality of substance abuse treatment records.3 (The regulations at 42 CFR Part 2 were issued under the authority of this statute.) SAMHSA is required to issue new regulations to implement the CARES Act changes, but these new rules will be effective no earlier than March 27, 2021. The CARES Act regulations are expected to align the 42 CFR Part 2 rules even more closely with the regulations relating to the use and disclosure of "protected health information" under the HIPAA Privacy Rule.
The July 15, 2020 final rule (the 2020 Final Rule) went into effect on August 14, 2020. The most important changes included in the 2020 Final Rule are summarized in this information memo.
"Records" Subject to 42 CFR Part 2
SAMHSA's confidentiality rules strictly limit the disclosure and use of substance use disorder records, so the precise scope of the term “records” is very important. Generally, covered records are defined very broadly include “any information, whether recorded or not, created by, received, or acquired by a Part 2 Program (that is, a substance use disorder treatment program) relating to a patient.” The 2020 Final Rule, however, somewhat limits the scope of the Part 2 restrictions, in two ways:
First, the 2020 Final Rule amends the definition of “records” in 42 CFR Part 2 to specifically exclude information conveyed orally by a Part 2 Program to a non-Part 2 health care provider (for example, the patient’s primary care physician) for treatment purposes, with the consent of the patient. The exclusion applies even if the oral information is reduced to writing by the non-Part 2 provider.
Second, the 2020 Final Rule states that treatment records created by a non-Part 2 provider based on their own patient encounters are exempted from Part 2, even if the provider had received a treatment record from a Part 2 Program, unless as long as the covered Part 2 record is not incorporated into the non-Part 2 records.
In the Preamble to the 2020 Final Rule, SAMSHA summarizes these two changes as follows:
[T]he intent is to allow the Part 2 Program to make a disclosure, with the patient’s consent, to the recipient non-Part 2 provider. In turn, the non-Part 2 provider can then carry out her own encounter with the patient, and create her own patient record, which will not fall under the coverage of Part 2.
In short, this change is intended to assure non-Part 2 providers (including primary care physicians) that records of their own patient encounters will not become subject to the strict Part 2 requirements merely because they receive a treatment record from a Part 2 Program. The overall intent is to facilitate coordination of care activities between Part 2 Programs and other care providers.
Example
A substance use disorder treatment facility discloses a treatment record to the patient's primary care physician, with the patient's consent. If the primary care physician keeps records of her own encounters with the patient, those records are not subject to 42 CFR Part 2, unless the primary care physician incorporates the received Part 2 record into her own records.
Note: In connection with these changes, SAMHSA also revised the standard “Prohibition on Redisclosure” notice that Part 2 Programs must provide when they disclose covered patient records, to state more clearly that only the Part 2 record itself is subject to the redisclosure prohibition.
Patient Consents
The 2020 Final Rule also revises some requirements of patient consents, by allowing patients to consent to disclosure of their Part 2 information to entities (health care institutions, governmental agencies, etc.) without naming the specific individual who will receive the information. The new rule allows patients to consent to disclosure of their information to a wider range of entities with whom they do not have a treatment relationship without having to name a specific individual to receive the information.
Example
A SUD treatment facility can disclose a patient's treatment record, with the patient's consent, to a non-medical provider (such as a halfway house) simply by entering the entity name in the consent form, without naming a specific individual who will receive the information.
Previously, a patient's consent to disclose a 42 CFR Part 2 record typically had to name a specific individual at an entity to which records were disclosed, if the patient did not have a treatment relationship with that entity.
Part 2 Information on Personal Devices
The 2020 Final Rule includes guidance on how Part 2 Program staff, including employees, volunteers, and trainees, should handle communications when using personal devices or accounts. If patient contact is made through a staff member’s personal email or cell phone account, not used in the regular course of business for the Part 2 Program, the staff member should immediately delete the information from his or her personal account and only respond via an authorized channel provided by the Part 2 Program, unless responding directly from the personal account is required to protect the best interests of the patient. Once immediate needs are addressed, the messages should be forwarded to an authorized channel (if containing patient identifying information) and deleted from the personal device. Eliminating the use of personal accounts will assist Part 2 Programs with record-keeping responsibilities, including the requirements to “sanitize” devices.
Clarifications as to Disclosures for Health Care Treatment, Payment or Operations
Previously, if a patient provided written consent to disclose their SUD records to a lawful holder for payment or healthcare operations purposes, the lawful holder could then redisclose the minimum necessary portion of these records to their contractors, subcontractors or legal representatives to fulfill those purposes without additional patient consent. The preamble to the 2018 Final Rule included an illustrative list of examples of “payment and healthcare operations” functions. However, the 2018 Final Rule prohibited redisclosures of SUD records by lawful holders to subcontractors, contractors and legal representatives for treatment purposes, so as to permit patients to determine where their personal information would be redisclosed for treatment purposes. Care coordination and case management were specifically excluded from the list of permissible payment and healthcare operations activities.
SAMHSA has reversed this decision in the 2020 Final Rule: care coordination and case management activities are specifically included as purposes for which a lawful holder, who has received Part 2 information with the patient’s consent, may make further disclosures as necessary to its contractors, subcontractors and legal representatives to support its payment and health care operations. Furthermore, the permissible "payment and health care operations" functions are now expressly stated in the regulations themselves.
It continues to be the rule that Part 2 information disclosed with the patient's consent for treatment purposes may not be further disclosed to a lawful holder’s contractors, subcontractors or legal representatives without the patient’s express consent.
Other Changes
Medical Emergencies: The Final Rule expands the list of medical emergencies, during which disclosures without patient consent are permitted, to include state or federally declared natural disasters or emergencies resulting from natural disasters (for example, hurricanes).
Research Disclosures: The rules that govern disclosures of SUD treatment records for research purposes have been expanded to permit disclosures by HIPAA covered entities to individuals and organizations that are neither HIPAA covered entities nor subject to the federal Common Rule.4 Such disclosures, however, must be made in accordance with the HIPAA Privacy Rule.
Audits and Evaluations: In the Final Rule, SAMHSA expanded and clarified which entities can conduct audits and evaluations and the activities that are permitted to be undertaken when an audit or evaluation takes place. Specifically, the 2020 Final Rule states that audits and evaluations can include reviews of the appropriateness of medical care, medical necessity and utilization review; and that entities conducting audits or evaluations in accordance with the new rule may include accreditation or similar organizations involved in quality assurance.
The changes made by the 2020 Final Rule are largely designed to provide more flexibility to substance abuse treatment programs and other health care providers with whom they deal, but 42 CFR Part 2 compliance remains a formidable task. Furthermore, as a result of the changes in the 2020 Final Rule, Part 2 Programs may have to update their consent forms, patient notices and redisclosure notices to comply with the 2020 Final Rule.
In addition, the CARES Act changes to 42 CFR Part 2 may be effective as soon as March 2021. We will summarize these new changes in a future information memo.
If you have any questions regarding the 2020 Final Rule or the 42 CFR Part 2 confidentiality requirements, please contact Rob Patterson or the attorney in the firm with whom you are regularly in contact.
