New Rule for Substance Abuse Records: Confidentiality and Disclosures
On January 2, 2018, the Substance Abuse and Mental Health Services Administration (“SAMHSA”) issued a Final Rule, amending 42 C.F.R Part 2 (“Part 2”), creating new changes to the federal rules governing confidentiality and disclosures of patient substance use disorder (“SUD”) records for the first time since 1987. Part 2 protects the confidentiality of SUD records, which are subset of protected health information (PHI). This means that these records are subject to HIPAA, but are also protected by Part 2, which contains additional (and more stringent) federal protections.
These overlapping standards can make the storage and disclosure of patient records administratively burdensome for healthcare providers, patients and their families. It is also a challenge for technology companies that store, analyze, and transmit patient records on behalf of providers and patients. Among other things, the Final Rule is a first pass at bridging the gap between these two laws. Its stated purpose is to streamline select requirements to ease some of this burden and to enable innovation.
Important changes that make sharing substance abuse records simpler
Payment and Health Care Operations Disclosure.
Under current law, redisclosure of SUD records is difficult and often requires multiple authorizations, which can delay and impede information sharing and, thus, treatment. The Final Rule allows an individual or entity that lawfully receives information protected by Part 2 (“lawful holder”) to further disclose the records to contractors, subcontractors, or legal representatives to carry out payment and/or health care operations activities, without additional patient consent, if such disclosure is for the purpose of payment and/or health care operations activities.
For example, it is permissible for a provider to disclose activities related to patient safety activities, patient safety work product, conducting medical review, legal services, or/and training of non-healthcare professionals without additional authorization by the patient. Consent is still required for disclosure for other purposes, such as patient diagnosis or medical treatment. Lawful holders should ensure that the purpose section of patient consent forms adequately describes permissible payment and healthcare operations for which the entity may disclose SUD records. SAMHSA has included a list of 17 specific types of permissible payment and health care operations as illustrative examples in the preamble to the Final Rule.
HIPAA Alignment.
Part 2 programs are “federally assisted” programs that hold themselves out as providing, alcohol or drug abuse diagnosis, treatment or referral for treatment. The Final Rule requires that both Part 2 programs and lawful holders have formal policies and procedures addressing the security of all records (both electronic and paper files)—this aligns Part 2 and HIPAA.
Abbreviated Notice for Re-Disclosure/Shorter Disclose.
The Final Rule authorizes providers to use a shorter written notice prohibiting the re-disclosure of patient records: “Federal law/42 CFR Part 2 prohibits disclosure of these records.” The shorter notice makes it easier for providers who use electronic health records systems by accommodating electronic systems that have character limitations on free text fields.
Audit and Evaluation Disclosure.
In the past, only Part 2 programs were allowed to disclose a patient’s SUD records for audit and evaluations without the patient’s consent. The Final Rule gives lawful holders the ability to disclose a patient’s substance abuse records for certain types of audit and evaluation purposes. This is meant to ease restrictions on sharing records with legal representatives, contractors, and sub-contractors.
The Final Rule took effect on February 2, 2018. Contracts between legal representatives, contractors, subcontractors, and lawful holders must be in compliance with the Final Rule by February 2, 2020. If you have any questions or would like additional clarifications about how the new rule might impact your business, please don’t hesitate to contact a Nixon Law Group Attorney.
Special thanks to Nixon Law Group law clerk Chelsea Ukoha for her assistance in researching this article.
Need help setting up compliant data privacy tools and processes? Click here to find out how we can help.
