On July 13, the Department of Health and Human Services’ Substance Abuse and Mental Health Services (“SAMHSA”) announced final revisions to the Confidentiality of Substance Use Disorder Patient Records regulation codified at 42 CFR Part 2 (so-called “Part 2” regulations). These regulations—which apply to certain information relating to patients being treated for substance use disorders (“SUDs”)—impose restrictions above and beyond those in the Health Insurance Portability and Accountability Act (“HIPAA”). While the final rule does not fundamentally change the basic requirements of the Part 2 regulations, it relaxes some of the restrictions the regulations impose on holders of Part 2 information, in particular, to facilitate care coordination.
The final rule makes the following changes to the regulations, among others:
- Clarifies that treatment records created by non-Part 2 health care providers that are based on their own contacts with patients are not covered by Part 2 restrictions, unless any SUD records that the provider previously received from a Part 2 program are incorporated into such records.
- Revises the regulation’s consent requirements to allow patients to consent to the disclosure of their information without naming a specific individual who may receive this information on behalf of a given entity with whom the individual does not have a treating provider relationship.
- Expressly incorporates into the regulatory text a list of activities considered “payment and healthcare operations” under Part 2, which are permissible with written consent. These activities include: billing, claims management and filing, underwriting, premium rating, collections activities, obtaining payment under a contract for reinsurance, healthcare data processing, clinical professional support services, and utilization review and management services.
- Significantly, the final rule also adds an additional activity to the list above: disclosures for the purpose of care coordination and case management. This addition is a result of Congress’ passage of the CARES Act in March, which expressly permits disclosure of Part 2 information for these purposes with written consent.
- Permits non-OTP (opioid treatment program) providers with a treating provider relationship with the patient to query a central registry to determine whether their patients are already receiving opioid treatment through a member program. Previously, the central registry could only disclose when asked by a ‘‘member program’’ whether an identified patient was enrolled in another member program. The final rule makes non-OTP providers with a treating provider relationship with the patient eligible to query a central registry to prevent duplicative enrollments and prescriptions for excessive opioids, as well as to prevent any adverse effects that may occur as a result of drug interactions with other needed medications.
- Permits OTPs to enroll in a state prescription drug monitoring program (“PDMP”) and to disclose dispensing and prescribing data when prescribing or dispensing medications on Schedules II to V, as required by applicable state law and subject to patient consent. SAMHSA has stated that it believes allowing for OTP reporting to PDMPs further enhances PDMPs as a tool to help prevent prescription drug misuse and opioid overdose, while providing more complete and accurate data.
Additional changes in the final rule include: clarifying provisions relating to research uses, audits and evaluations, and the disposal of SUD patient information on personal devices of employees; extending the length of time a court-ordered undercover agent can be placed within a Part 2 program; and expanding the exception applicable to emergencies relating to natural disasters.
The final rule can be reviewed in its entirety here, and becomes effective August 14, 2020.