On January 3, 2018, the Department of Health and Human Services, Substance Abuse and Mental Health Services Administration (“SAMHSA”) published a final rule at 83 FR 239 (the “Final Rule”), to be effective February 2, 2018, implementing further changes to the Confidentiality of Substance Use Disorder Patient Records regulations at 42 C.F.R. Part 2 (“Part 2”), in addition to those revisions finalized early last year (the first substantive revisions in nearly 30 years). Part 2 protects the confidentiality of patient records and identifying information related to the identity, diagnosis, prognosis, or treatment of patients in a Part 2 Program. Part 2 applies to a federally assisted program (which includes programs that are participating providers in the Medicare program) that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment, which can include an identified unit within a general medical facility (a “Part 2 Program”). Among other changes, this Final Rule creates Section 2.33(c) which requires lawful holders of patient identifying information to enter into contracts with their contractors or subcontractors, as discussed further below. This Final Rule further amends 42 C.F.R. Sections 2.32 (Prohibition on re-disclosure), 2.33 (Disclosures permitted with written consent), 2.35 (Disclosure to elements of the criminal justice system which have referred patients), and 2.53 (Audit and evaluation). This Client Alert focuses on the revisions to Sections 2.32 and 2.33.

Written Contracts with Contractors and Subcontractors

Under Part 2, a Part 2 Program may only disclose patient identifying information pursuant to the patient’s written consent, pursuant to a court order or under a few limited exceptions (i.e., cases of suspected child abuse or neglect, medical emergencies, and crimes on the premises). Historically, even pursuant to patient written consent, the Part 2 regulations generally prohibit a “lawful holder of patient identifying information” to re-disclose such patient identifying information for any reason. A “lawful holder of patient identifying information” is an individual or an entity that receives patient identifying information pursuant to a patient’s Part 2 compliant written consent. The Final Rule makes significant changes to this prohibition.
Now, pursuant to new Sections 2.33(b) and 2.33(c), lawful holders of patient identifying information may further disclose that information to their contractors, subcontractors and legal representatives for purposes of payment and health care operations provided the core protections of Part 2 are maintained and the lawful holder enters into a written contract with such contractor (discussed below).

Within two years from the effective date of the Final Rule (i.e., February 3, 2020), lawful holders of patient identifying information who desire to disclose such information to their contractors and subcontractors for purposes of payment and health care operations activities (as set forth below) must enter into written contracts (or a comparable legal instrument with respect to voluntary legal representatives) that require such contractors to comply with the provisions of Part 2. 

The written contract (or comparable legal instrument) between the legal holder and the contractor or voluntary legal representative must comply with the following requirements:

1. The contractor, subcontractor or voluntary legal representative must be fully bound by the provisions of part 2 upon receipt of patient identifying information.
   Note, the contract must specifically identify Part 2 compliance. Contractual language of general compliance with applicable federal laws does not satisfy this requirement.
   
2. The legal holder must furnish such recipient with the notice required under Section 2.32 (discussed below).
3. Such recipient must implement appropriate safeguards (not defined by regulation) to prevent unauthorized uses and disclosures.
4. Such recipient must report any unauthorized uses, disclosures or breaches of patient identifying information to the lawful holder.
5. The lawful holder may only disclose information to the contractor, subcontractor or voluntary legal representative that is necessary for the contractor, subcontractor or voluntary legal representative to perform its duties under the contract or comparable legal instrument.
6. The contract may not permit a contractor, subcontractor or voluntary legal representative to re-disclose information to a third party unless that third party is a contract agent of the contractor or subcontractor, helping them provide services described in the contract, and only as long as the agent only further discloses the information back to the contractor or lawful holder from which the information originated.

SAMHSA does not provide specific contractual language to implement Section 2.33(c).

Payment and health care operations activities include billing and claims management; patient safety activities; third-party liability coverage; activities related to addressing fraud, waste and abuse; QAI and utilization review activities; business planning and management; the sale, transfer, merger, consolidation or dissolution of an organization; etc. However, the Final Rule expressly excludes from the definition of payment and health care operations diagnosis, treatment, referrals for treatment, care coordination or case management.

Note, lawful holders who choose not to re-disclose patient identifying information to contractors, subcontractors or legal representatives for payment and health care operations are not required to comply with Section 2.33(c).

Abbreviated Notice Requirements, Section 2.32(a) 

Part 2 has historically required a very lengthy notice be provided pursuant to a disclosure made with a patient’s written consent. The Final Rule permits the Part 2 program to utilize an abbreviated notice that prohibits re-disclosure when disclosing patient identifying information pursuant to patient written consent. The abbreviated notice reads, “42 C.F.R. part 2 prohibits unauthorized disclosure of these
records.” Part 2 providers may use this abbreviated notice as an alternative to the lengthier notice in any instance in which notice is required. Part 2 providers are not required to modify existing forms or processes to implement the shorter notice and may continue to use the lengthier notice set forth at 42 C.F.R. Section 2.32(a)(1).

Compliance with the Final Rule 

The effective date of the Final Rule is February 2, 2018, which is the compliance date for all provisions of the Final Rule, except for Section 2.33(c). Contracts between lawful holders and contractors, subcontractors, and legal representatives must comply with Section 2.33(c) within two years of the effective date of the Final Rule.

If you have questions regarding the confidentiality of substance use disorder patient records or whether the revisions to Part 2 apply to you or your company, please contact one of the authors.