After nearly a full year of public comment consideration, last week, the U.S. Department of Health and Human Services (HHS) Substance Abuse and Mental Health Services Administration (SAMHSA) announced and published a Final Rule and Fact Sheet addressing 42 C.F.R. Part 2 (Part 2). Generally speaking, Part 2 affords privacy protections to patient records pertaining to federally assisted substance use disorder (SUD) treatment programs. The Proposed Rule, released in August 2019, sought to balance the privacy protections of SUD patients with the need for updated coordinated care regulations. Specifically, the Proposed Rule focused on: updating protection protocol for both Part 2 and non-Part 2 records; clarifying federal standards for obtaining patient consent to disclose SUD records to various entities; and preventing duplicative SUD program enrollments and prescriptions.

The recent Final Rule implements these changes in the following ways:

  1. The Final Rule updates standards for the protection and management of Part 2 and non-Part 2 records.

The Final Rule seeks to facilitate improved coordination of care between Part 2 and non-Part 2 providers by clarifying the applicability of Part 2 requirements to non-Part 2 providers. First, the Final Rule updates the definition of “records” in 42 C.F.R. § 2.11. Under the previous definition, there was concern as to whether non-Part 2 providers could inadvertently render their own records subject to Part 2 when treating SUD patients by using patient records received from Part 2 providers to inform their own subsequent clinical encounters with and record-keeping on those patients. Under the new definition, non-Part 2 providers may receive oral disclosures from a Part 2 provider, with consent of the patient, for treatment purposes and reduce that disclosure to writing without the disclosed information thereby becoming a Part 2 record. This allows non-Part 2 providers to receive and record important information regarding the SUDs and treatment of patients with whom they have clinical encounters, without subjecting their own records to the rigors of Part 2.

Second, the Final Rule revises 42 C.F.R. § 2.12 to clarify that records generated by non-Part 2 providers based on their own patient encounters are generally not covered by Part 2 protections, even to the extent the records include information about a SUD and its treatment. However, if any SUD records from a Part 2 program are incorporated into non-Part 2 provider records, then the entire record would become subject to Part 2. To avoid the application of Part 2 requirements to non-Part 2 provider records, the Final Rule advises that the respective records should be “segregated.” Segregating the received Part 2 record from the non-Part 2 provider’s own record will allow the provider to ensure that the non-Part 2 records can be distinguished from the received record and, thus, not become subject to Part 2 requirements.

Importantly, the revisions to § 2.11 and § 2.12 work in concert to permit a Part 2 Program to make a disclosure with the patient’s consent, orally or in writing, to a recipient non-Part 2 provider and allow the non-Part 2 provider to subsequently have her own encounter with the patient and create her own patient record, which will not be subject to Part 2, even to the extent the non-Part 2 provider records information about the patient’s SUD and its treatment within that record. Notably, the requirement remains for received Part 2 records to be segregated from non-Part 2 providers’ own created records in order to insulate the latter from Part 2 regulations. Together, these changes are intended to promote secure SUD record management and facilitate care coordination among Part 2 and non-Part 2 providers.

2. The Final Rule clarifies parameters for patient consent to disclose Part 2 treatment records.

The Final Rule also revises the patient consent requirements under Part 2 in an effort to remove barriers to care coordination and expand patients’ ability to consent to disclosure of their own information.

Previously, in order for a Part 2 program or other lawful holder to disclose patient information to an entity that (1) did not have a treating provider relationship with the patient and (2) was not a third-party payor, Part 2 required the written consent document to designate both the name of the recipient entity and the name of a specific individual designated to receive the information. The Final Rule revises the consent requirements to remove the distinction between entities with a treating provider relationship and entities without a treating provider relationship, and to permit the consent to merely designate the name of the individuals or entities to whom a disclosure may be made. For instance, with this update, a patient now may simply name “Social Security Administration” as the recipient entity, without needing to also designate a specific individual at the agency to receive the information. These changes will allow patients to more easily disclose their own information to entities with which they do not have a treating provider relationship. Notably, however, the Final Rule preserves certain treating provider relationship distinctions for recipient entities that are research institutions or those that facilitate the exchange of health information.

Additionally, the Final Rule clarifies the scope of permitted disclosures with patient consent for “payment and health care operations” under 42 C.F.R. § 2.33(b) by incorporating a list of 19 illustrative (but not exhaustive) examples of permissible activities into the regulatory text. Notably, these examples include the same examples provided by SAMHSA in the preamble to the 2018 Final Rule. Additionally, we note that although SAMHSA indicated in the Proposed Rule that “health care operations” do not include disclosures for care coordination and case management, SAMHSA revised this position in the Final Rule based on public comments and the passage of the CARES Act, which expressly permits disclosure of Part 2 information for these purposes. As such, the Final Rule specifically includes care coordination and case management services in the list of permissible activities under § 2.33(b). Further, although this list of permissible activities will provide some clarity to Part 2 providers, SAMHSA also included language that permits disclosures for “other payment/health care operations activities not expressly prohibited,” which leaves the restriction on disclosures subject to interpretation.

3. The Final Rule provides methods for programs and providers to track SUD program enrollments and activities.

Finally, the Final Rule also seeks to remove barriers to the exchange of information among Part 2 and non-Part 2 providers in an effort to ensure the appropriate use of opioid therapies and reduce the risk of diversion and adverse events. First, the Final Rule expands § 2.34, relating to central registries containing information about individuals applying for withdrawal management or maintenance therapy for SUDs. This expansion permits non-Part 2 providers with a treating provider relationship with a patient to query central registries to determine whether the patient is receiving opioid treatment through an opioid treatment program (OTP). Queries can be used to prevent duplicative enrollments and/or to inform the provider’s decision making regarding the prescription of opioid medications. Second, the Final Rule adds a new section, § 2.36, which explicitly permits Part 2 programs, including OTPs, to enroll in prescription drug monitoring programs (PDMPs) in their respective states and report to the PDMP when prescribing or dispensing medications. These changes will help improve care coordination among providers treating patients with SUDs and will improve access to complete patient information, which will in turn enable providers to make more informed decisions regarding patient care.

These revisions to Part 2 were intended to clarify the parameters of patient consent for SUD disclosure and increase the ease of coordinated care among Part 2 and non-Part 2 providers. HHS asserts the Final Rule will also improve the quality of care for those with SUDs as well as further align Part 2 standards with HIPAA regulations. As both Part 2 and non-Part 2 providers are affected by the Final Rule, it will be important for all impacted entities to revisit their policies on maintaining and disclosing SUD patient records in order to achieve compliance with SAMHSA standards.

Reed Smith will soon issue a Client Alert to describe the Final Rule in greater detail, and advise on the implications of this agency action.