January 11, 2018
Kate Tipping (Office of the National Coordinator for Health Information Technology, Washington, DC)
This Bulletin is brought to you by the Behavioral Health Task Force.
On January 3, 2018, the Substance Abuse and Mental Health Service Administration (SAMHSA) issued its final rule which further revises the Confidentiality of Substance Use Disorder Patient Records regulations (42 C.F.R. pt. 2) (herein after, “Part 2”). The final rule seeks to better align the regulations with advances in the U.S. health care delivery system while retaining important privacy protections for individuals seeking treatment for substance use disorders.1
This rule finalizes changes proposed in the supplemental notice of proposed rulemaking (SNPRM) issued on January 18, 2017.2 The SNPRM was published at the same time SAMHSA finalized the first major, substantive revisions to Part 2 in nearly 30 years.3 The SNPRM solicited public comment on additional proposals including: payment and health care operations-related disclosures by lawful holders that could be made to contractors, subcontractors, and legal representatives under the Part 2 consent provisions; and the provisions governing disclosures for purposes of carrying out a Medicaid, Medicare, or Children's Health Insurance Program (CHIP) audit or evaluation. SAMHSA also solicited comment on whether an abbreviated notice of the prohibition on re-disclosure should be used and, if so, under what circumstances. A brief summary of the major proposals and final revisions is included below.
- Disclosures permitted with written consent. In the SNPRM, SAMHSA proposed to explicitly list the specific types of activities for which any lawful holder of patient identifying information would be permitted to further disclose the minimal information necessary for specific payment and health care operations activities. SAMHSA proposed to add new regulatory text that would require lawful holders that engage contractors and subcontractors for purposes of payment and health care operations and use or disclose patient identifying information to them to include specific contract provisions addressing compliance with Part 2. The final rule permits additional disclosures of patient identifying information, with patient consent, to contractors, sub-contractors, and legal representatives as necessary for purposes of payment and health care operations. The final rule includes the list of examples of permissible payment and health care operations activities in the preamble, not in regulatory text. The final rule also includes a provision (§ 2.33(c))addressing contracts and comparable legal instruments, which provide that the contractor, subcontractor, or voluntary legal representative agrees to be fully bound by the provisions of Part 2 upon receipt of the patient identifying information shared for payment and health care operations purposes.
- Audit and Evaluation. In the SNPRM, SAMHSA proposed regulatory changes to clarify that audits and evaluations may be performed on behalf of federal, state, and local governments providing financial assistance to, or regulating the activities of, lawful holders as well as Part 2 programs. In the SNPRM, SAMHSA also proposed regulatory revisions to specify that audits and evaluations may be performed by contractors, subcontractors, or legal representatives on behalf of third-party payers or quality improvement organizations or for purposes of conducting a Medicare, Medicaid, or CHIP audit or evaluation. The final rule permits further disclosures to contractors, subcontractors, and legal representatives for purposes of carrying out a Medicaid, Medicare, or CHIP audit or evaluation and audits and evaluations of other lawful holders of patient identifying information.
- Prohibition on re-disclosure. In the SNPRM, SAMHSA proposed the option of an abbreviated notice to satisfy the requirements of the notice of prohibition on re-disclosure due to concerns about character limits in free-text fields within health information technology (IT) systems. Specifically, many of the health IT systems have a standard maximum character limit of 80 characters in the free text space that may be used to transmit this notice. The final rule permits the use of an abbreviated notice of prohibition on re-disclosure in lieu of the longer standard notice, which may assist users of health IT systems in complying with the requirement by permitting a shorter notice that would fit in the standard free-text space. The use of an abbreviated notice is permitted in any instance in which a notice is required. SAMSHA hopes that this provision will facilitate adoption of electronic health records and reduce regulatory burdens.
These changes go into effect on February 2, 2018. Contracts and comparable legal instruments between lawful holders and contractors, subcontractors, and legal representatives must comply with § 2.33(c) within two years of the effective date of the final rule. In response to a number of public comments and recommendations, SAMHSA stated that it is contemplating future rulemaking for Part 2, and would consider these comments and recommendations at that time. SAMSHA also emphasized additional alignment with the Health Insurance Portability and Accountability Act (HIPAA). As required by the 21st Century Cures Act (P.L. 114-255), SAMHSA plans to hold a public meeting to obtain additional input from stakeholders about the effect of Part 2 on patient privacy, health outcomes, and patient care. SAMHSA released a Federal Register Notice on January 9, 2018 announcing the details of the public meeting, which is scheduled for January 31, 2018.4
1 Confidentiality of Substance Use Disorder Patient Records, 83 Fed. Reg. 239 (Jan. 3, 2018) (to be codified at 42 C.F.R. pt. 2).
2 Confidentiality of Substance Use Disorder Patient Records, 82 Fed. Reg. 5485 (proposed Jan. 18, 2017) (to be codified at 42 C.F.R. pt. 2).
3 Confidentiality of Substance Use Disorder Patient Records, 82 Fed. Reg. 6052 (Jan. 18, 2017) (to be codified at 42 C.F.R. pt. 2).
4 Confidentiality of Substance Use Disorder Patient Records, 8 Fed. Reg. 1041 (Jan. 9, 2018).