The Substance Abuse and Mental Health Services Administration (“SAMHSA”), an agency within the U.S. Department of Health and Human Services, recently published changes to the federal substance use disorder confidentiality rules at 42 C.F.R. Part 2.* These rules, commonly known as “Part 2”, impose strict confidentiality requirements on federally assisted health care providers that diagnose, treat, and refer for treatment of substance use disorders (“SUD”). The changes are effective August 14, 2020.
SAMHSA states that the purposes of these changes are to lighten provider burdens in coordinating care and align Part 2 with other privacy laws (e.g., HIPAA). The changes leave intact the basic framework for Part 2, including the rules on which providers are subject to Part 2. The following is a summary of the major changes:
Records covered by Part 2 no longer include information conveyed verbally by a Part 2 provider – with the consent of the patient – to a non-Part 2 provider for treatment purposes. If the non-Part 2 provider documents the verbally conveyed information, these documents are not Part 2 records.
SAMHSA has clarified that a non-Part 2 provider that records information about a SUD does not make that record subject to Part 2 if the non-Part 2 provider segregates the records received from a Part 2 program from the non-Part 2 provider’s own records.
Written authorization form requirements on designating the recipient of the information are relaxed.
A patient may generally authorize a lawful holder of Part 2 information (such as a third party payor) to disclose Part 2 information for payment and health care operations activities. The Part 2 rules clarify what these activities are.
Part 2 providers may delete incidentally received Part 2 messages from patients, such as text messages, from personal devices.
An exception is created allowing Part 2 opioid treatment program providers to report SUD medication prescribed or dispensed to a state prescription monitoring program (“PMP”) consistent with state law. However, sharing Part 2 records and information (other than making the report) with a PMP still requires a written authorization.
The Part 2 “bona fide medical emergency” disclosure exception is expanded. The revision provides that such emergencies include state or federally declared natural disaster emergencies that impair services.
The rules on disclosures for research purposes are relaxed to permit disclosures to certain entities that are not subject to HIPAA or U.S. DHHS rules on human research subjects (the “Common Rule”).
The exceptions for disclosures for audits and program evaluation purposes are clarified to allow sharing of patient identifying information if the audit cannot be conducted with deidentified information.
These changes do not incorporate the Part 2 rulemaking mandated by Congress in the CARES Act. The CARES Act contains changes intended to further align Part 2 with HIPAA. Under the CARES Act, SAMHSA must make these changes by March 27, 2021.
* * *
Part 2 providers and recipients of Part 2 information that are “lawful holders” subject to Part 2 should review these enacted changes, make any necessary revisions to policies and procedures, and operationalize these revisions when the changes become effective on August 14, 2020. If you have questions about these changes or about other aspects of Part 2, please feel free to contact Mike Burian, Steve Johnson, or Taylor Fawns at Kozak & Gayer.
* The changes are available at 85 Fed. Reg. 42986 (Jul. 15, 2020).