At Long Last, SAMHSA Issues Final Rule Regarding Confidentiality of Substance Use Disorder Records

January 19, 2017 Alerts and Newsletters

On January 18, 2017, the Substance Abuse and Mental Health Services Administration ("SAMHSA") published a final rule revising the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, commonly known as "Part 2" (the "Final Rule"), for the first time in 29 years. The Final Rule adds flexibility and facilitates information exchange within new health care models while maintaining patient confidentiality. This alert provides an overview of the major changes and clarifications in the Final Rule, as well as practical guidance for implementing the new requirements.

Applicability to Lawful Holders of Patient Identifying Information. An entity is a lawful holder of patient identifying information if it has received such information either via a Part 2-compliant consent or through an exception to the Part 2 consent requirements. For example, treating providers, insurance companies and individuals or entities conducting research could all be lawful holders. Lawful holders must comply with Part 2's restrictions on disclosing patient identifying information, meaning they must obtain patient consent to disclose such information unless the disclosure is subject to an exception to the consent requirement. The Final Rule clarifies, but does not significantly alter, entities' Part 2 responsibilities, because the longstanding prohibition on re-disclosure of information from Part 2 programs already prohibited recipients of patient identifying information, such as HIEs, from re-disclosing it without obtaining patient consent.

General Designation of Treating Providers Within Non-Treating Provider Entities. Prior to its revision, Part 2 posed problems for entities that are not treating providers, such as HIEs, CCOs and ACOs, that receive patient identifying information to facilitate information exchange and care coordination. For example, a patient could consent to a disclosure to an HIE, but, if a new provider joined the HIE after the patient signed the consent, Part 2 required the new provider to obtain consent to receive the patient's information if the patient sought treatment from that provider. The Final Rule requires a patient, when consenting to disclosure to an HIE, to further designate treating providers in the HIE that can also receive the information. Of practical importance, the patient's designation can be very general, such as to "all current and future treating providers." The Final Rule resolves a practical issue for entities trying to improve information sharing by introducing additional flexibility with respect to the entities that may receive patient identifying information pursuant to a general designation.

List of Disclosures. With the revised consent and disclosure standard comes a related requirement. If a patient uses a general designation to consent to a disclosure to a non-treating provider entity, the recipient entity must, upon request, provide the patient with a List of Disclosures detailing to whom the entity has disclosed the patient's information. The requirement applies to intermediaries such as HIEs, ACOs and CCOs, and SAMHSA has noted that "the general designation on a consent form may not be used until entities have the ability to comply with the List of Disclosures provision." The disclosures are limited to those that occurred within two years of the request.

Disclosures for Research. The Final Rule now allows not only Part 2 programs, but also other lawful holders of patient identifying information, such as HIEs, CCOs and ACOs, to disclose such information to qualified personnel conducting research, under certain circumstances, without patient consent. To be eligible to receive information, a researcher must be a HIPAA covered entity or a business associate with an appropriate authorization or waiver, or an entity subject to the HHS Common Rule, again with an appropriate waiver or authorization. The Final Rule now allows researchers to link data sets from both federal and non-federal repositories, subject to certain conditions. The revisions should improve research capabilities by enhancing researcher access to substance use disorder data.

Prohibition on Re-Disclosure. The Final Rule clarifies that the prohibition on re-disclosure applies only to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment of a substance use disorder. This clarification means that the re-disclosure prohibition does not apply to health information pertaining to an unrelated health condition. The clarification is designed to minimize decisions by Part 2 programs to protect the entire patient record.

Practical Implications and Implementation Guidance

The Final Rule is effective February 17, 2017. Part 2 programs and other lawful holders of patient identifying information must comply with the Final Rule's new requirements, including, but not limited to, the following:

  • When a patient consents to disclosure to a non-treating provider entity, the patient must further designate, for disclosure purposes, treating provider individuals or entities within the non-treating provider entity; consent forms must allow patients to make such designations.
  • A non-treating provider entity that discloses patient identifying information pursuant to a patient consent with a general designation must be able to provide, upon patient request, a List of Disclosures within 30 days of its receipt of the written request.
  • Consent forms must now identify a specific contact and provide contact information for reporting Part 2 violations.
  • Lawful holders of patient identifying information must have formal written policies and procedures to protect against unauthorized uses and disclosures of patient identifying information, and to protect its security.

In order to comply with these new requirements, Part 2 programs and lawful holders must take the following actions:

  • Revise consent forms to permit patients to designate individuals and entities within a non-treating provider entity to whom the patient is consenting to disclosure and to identify a contact, with contact information, for reporting Part 2 violations.
  • Develop a template List of Disclosures for tracking disclosures that must be provided pursuant to a patient request. The template must include the name of the entities to which disclosure was made, the date of disclosure, and a brief description of the patient identifying information disclosed.
  • Draft or augment formal written security policies and procedures to reflect the Part 2 security measures.
  • Implement security measures that comply with the Part 2 requirements.

Finally, at the same time it issued the new rule, SAMHSA issued a Supplemental Notice of Proposed Rulemaking ("SNPRM"), to address the scope of permissible disclosures. The comment period for the SNPRM ends on February 17, 2017.

If you have questions about the new regulations, please contact Kate Healy, Cecilie MacIntyre or another member of Verrill Dana's Health Care Team.

This communication is intended for general information purposes and as a service to clients and friends of Verrill Dana, LLP. This publication, which may be considered advertising under the ethical rules of certain jurisdictions, should not be construed as legal advice or a legal opinion on any specific facts or circumstances, nor does it create attorney-client privilege.

Firm Highlights


Conflicts of Interest

Reviewed medical center's systems, policies and procedures for identifying, assessing, and managing investigator and institutional conflicts of interest.


38 Verrill Attorneys, Across Four Offices, Recognized in 2020 Chambers & Partners Guide

(April 27, 2020) – Verrill has been rated as a Leading Firm in a total of ten categories and subcategories as evaluated by London-based Chambers & Partners , one of the world's most respected...


FDA Updates its Guidance on Conducting Clinical Trials During COVID-19 Public Health Emergency

On April 16, 2020, the U.S. Food & Drug Administration (“FDA”) again updated its guidance on the “Conduct of Clinical Trials of Medical Products during COVID-19 Public Health Emergency,” adding seven new questions and...


EU-U.S. Privacy Shield Invalidated: Does Your Company Have a Plan B?

On Thursday, July 16, 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield (“Privacy Shield”) in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (Case C-311/18...


Nearly 80 Verrill Attorneys Recognized by Best Lawyers® 2021, Including a Dozen Named Lawyers of the Year

(August 24, 2020) – Nearly 80 Verrill attorneys were recognized as "Best Lawyers" by Best Lawyers® 2021 , including 12 attorneys named “Lawyer of the Year,” a distinguished recognition for only a single lawyer...


Michael K. Fee to Lead Verrill’s Nationally-Recognized Health Care and Life Sciences Practice Amidst Recent Changes

(August 31, 2020) – Verrill is pleased to announce Michael K. Fee as the new leader of Verrill’s nationally-recognized Health Care & Life Sciences Group. The Group has a long history of representing a...


News Flash: HHS Issues Statement Removing Premarket Review Requirements for Laboratory Developed Tests (“LDTs”), Including COVID-19 LDTs

What happened? On August 19, 2020, the U.S. Department of Health and Human Services (“HHS”) issued a single paragraph statement rescinding U.S. Food and Drug Administration (“FDA”) guidance documents concerning premarket review of Laboratory...


Multi-Site Global Research

Developed and negotiated site and coordinating center agreements in connection with a multi-site, international, National Institutes of Health (NIH)-funded study, and advised on regulatory issues related to the conduct of the study and subsequent...


FDA Issues Guidance on IRB Review of Non-Emergency Individual Patient Expanded Access Requests for Investigational Drugs and Biological Products to Treat COVID-19

Prompted by a substantial increase in requests for individual patient access to investigational drugs and biologics to treat COVID-19, the U.S. Food & Drug Administration (“FDA”) issued guidance on June 2, 2020 that outlines...


European Union GDPR—Institution

Counseled a preeminent health system and academic medical center on its compliance with the European Union General Data Protection Regulation (GDPR) in relation to its clinical and research activities, including its international research studies...