At Long Last, SAMHSA Issues Final Rule Regarding Confidentiality of Substance Use Disorder Records

January 19, 2017 Alerts and Newsletters

On January 18, 2017, the Substance Abuse and Mental Health Services Administration ("SAMHSA") published a final rule revising the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, commonly known as "Part 2" (the "Final Rule"), for the first time in 29 years. The Final Rule adds flexibility and facilitates information exchange within new health care models while maintaining patient confidentiality. This alert provides an overview of the major changes and clarifications in the Final Rule, as well as practical guidance for implementing the new requirements.

Applicability to Lawful Holders of Patient Identifying Information. An entity is a lawful holder of patient identifying information if it has received such information either via a Part 2-compliant consent or through an exception to the Part 2 consent requirements. For example, treating providers, insurance companies and individuals or entities conducting research could all be lawful holders. Lawful holders must comply with Part 2's restrictions on disclosing patient identifying information, meaning they must obtain patient consent to disclose such information unless the disclosure is subject to an exception to the consent requirement. The Final Rule clarifies, but does not significantly alter, entities' Part 2 responsibilities, because the longstanding prohibition on re-disclosure of information from Part 2 programs already prohibited recipients of patient identifying information, such as HIEs, from re-disclosing it without obtaining patient consent.

General Designation of Treating Providers Within Non-Treating Provider Entities. Prior to its revision, Part 2 posed problems for entities that are not treating providers, such as HIEs, CCOs and ACOs, that receive patient identifying information to facilitate information exchange and care coordination. For example, a patient could consent to a disclosure to an HIE, but, if a new provider joined the HIE after the patient signed the consent, Part 2 required the new provider to obtain consent to receive the patient's information if the patient sought treatment from that provider. The Final Rule requires a patient, when consenting to disclosure to an HIE, to further designate treating providers in the HIE that can also receive the information. Of practical importance, the patient's designation can be very general, such as to "all current and future treating providers." The Final Rule resolves a practical issue for entities trying to improve information sharing by introducing additional flexibility with respect to the entities that may receive patient identifying information pursuant to a general designation.

List of Disclosures. With the revised consent and disclosure standard comes a related requirement. If a patient uses a general designation to consent to a disclosure to a non-treating provider entity, the recipient entity must, upon request, provide the patient with a List of Disclosures detailing to whom the entity has disclosed the patient's information. The requirement applies to intermediaries such as HIEs, ACOs and CCOs, and SAMHSA has noted that "the general designation on a consent form may not be used until entities have the ability to comply with the List of Disclosures provision." The disclosures are limited to those that occurred within two years of the request.

Disclosures for Research. The Final Rule now allows not only Part 2 programs, but also other lawful holders of patient identifying information, such as HIEs, CCOs and ACOs, to disclose such information to qualified personnel conducting research, under certain circumstances, without patient consent. To be eligible to receive information, a researcher must be a HIPAA covered entity or a business associate with an appropriate authorization or waiver, or an entity subject to the HHS Common Rule, again with an appropriate waiver or authorization. The Final Rule now allows researchers to link data sets from both federal and non-federal repositories, subject to certain conditions. The revisions should improve research capabilities by enhancing researcher access to substance use disorder data.

Prohibition on Re-Disclosure. The Final Rule clarifies that the prohibition on re-disclosure applies only to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment of a substance use disorder. This clarification means that the re-disclosure prohibition does not apply to health information pertaining to an unrelated health condition. The clarification is designed to minimize decisions by Part 2 programs to protect the entire patient record.

Practical Implications and Implementation Guidance

The Final Rule is effective February 17, 2017. Part 2 programs and other lawful holders of patient identifying information must comply with the Final Rule's new requirements, including, but not limited to, the following:

  • When a patient consents to disclosure to a non-treating provider entity, the patient must further designate, for disclosure purposes, treating provider individuals or entities within the non-treating provider entity; consent forms must allow patients to make such designations.
  • A non-treating provider entity that discloses patient identifying information pursuant to a patient consent with a general designation must be able to provide, upon patient request, a List of Disclosures within 30 days of its receipt of the written request.
  • Consent forms must now identify a specific contact and provide contact information for reporting Part 2 violations.
  • Lawful holders of patient identifying information must have formal written policies and procedures to protect against unauthorized uses and disclosures of patient identifying information, and to protect its security.

In order to comply with these new requirements, Part 2 programs and lawful holders must take the following actions:

  • Revise consent forms to permit patients to designate individuals and entities within a non-treating provider entity to whom the patient is consenting to disclosure and to identify a contact, with contact information, for reporting Part 2 violations.
  • Develop a template List of Disclosures for tracking disclosures that must be provided pursuant to a patient request. The template must include the name of the entities to which disclosure was made, the date of disclosure, and a brief description of the patient identifying information disclosed.
  • Draft or augment formal written security policies and procedures to reflect the Part 2 security measures.
  • Implement security measures that comply with the Part 2 requirements.

Finally, at the same time it issued the new rule, SAMHSA issued a Supplemental Notice of Proposed Rulemaking ("SNPRM"), to address the scope of permissible disclosures. The comment period for the SNPRM ends on February 17, 2017.

If you have questions about the new regulations, please contact Kate Healy, Cecilie MacIntyre or another member of Verrill Dana's Health Care Team.

This communication is intended for general information purposes and as a service to clients and friends of Verrill Dana, LLP. This publication, which may be considered advertising under the ethical rules of certain jurisdictions, should not be construed as legal advice or a legal opinion on any specific facts or circumstances, nor does it create attorney-client privilege.

Firm Highlights


340B Providers Get Partial Relief from New Dispute Resolution Regulation

1. 340B ADR Process Established At long last, more than ten years after Congress directed it to do so, HHS has finalized an alternative dispute resolution (“ADR”) process for both providers and pharmaceutical manufacturers...


65 Verrill Attorneys Recognized by Best Lawyers® 2022, Including Eight Named Lawyers of the Year

(August 31, 2021) – 65 Verrill attorneys were recognized as "Best Lawyers" by Best Lawyers® 2022 , including 8 attorneys named “Lawyer of the Year,” a distinguished recognition for only a single lawyer in...


HHS Confirms Providers’ Right to 340B Discount Pricing for Contract Pharmacies

As a holiday gift to providers, the U.S. Department of Health and Human Services (HHS) General Counsel recently issued a strongly worded Advisory Opinion indicating that federal law requires drug manufacturers to deliver covered...


Hospital Price Transparency Rule: Full Steam Ahead

Neither COVID-19 nor continued legal challenges appear likely to derail the Centers for Medicare & Medicaid Services ( CMS) Hospital Price Transparency Rule from going into effect on January 1, 2021. Hospitals therefore should...


Verrill Welcomes Jeffrey A. Smagula, Experienced Health Care and Life Sciences Attorney, Former Health Plan Compliance Executive

(May 12, 2021) – Verrill is pleased to welcome Jeffrey A. Smagula to the firm’s Boston office as Counsel in its nationally recognized Health Care & Life Sciences Group. Jeff Smagula brings to Verrill...


Fraud and Abuse Investigations Handbook for the Health Care Industry, Second Edition.

Health care attorney Paul Shaw co-authored Fraud and Abuse Investigations Handbook for the Health Care Industry, Second Edition with Robert Griffith, published by the American Health Law Association (AHLA). Paul and Robert provide legal...


Massachusetts Health Care Bill Makes Several Significant Changes

While you were celebrating the New Year, Governor Baker signed Chapter 260 of the Acts of 2020, an “Act promoting a resilient health care system that puts patients first,” the result of the Legislature’s...


“If I've told you once, I've told you eight times…” HHS OIG Issues Another Audit Report on Hospitals’ Failure to Report Credits for Explanted Cardiac Devices and Lays the Groundwork Collection of Overpayments


The Regulatory Sprint is Over - What’s at the Finish Line Under the New Stark and AKS Final Rules?

The U.S. Department of Health and Human Services (HHS) completed its “Regulatory Sprint” by finalizing changes to regulations pertaining to two federal fraud and abuse laws. On December 2, 2020, the Centers for Medicare...

Contact Verrill at (855) 307 0700