Redline of Recent Revisions to the Confidentiality of Substance Use Disorder Patient Records Regulations

February 5, 2018 Alerts and Newsletters

On January 2, 2018, the Substance Abuse and Mental Health Services Administration ("SAMHSA") published revisions to 42 C.F.R. Part 2, Confidentiality of Substance Use Disorder Patient Records ("Part 2"). SAMHSA indicated that the changes were "intended to better align the regulations with advances in the U.S. health care delivery system while retaining important protections for individuals seeking treatment for substance use disorders."

The revisions, effective as of February 2, 2018, reflect the operational realities of the current health care delivery system, such as the rise in integrated health settings. Notable highlights include:

  • The required statement regarding re-disclosure may now be either the lengthy statement from the prior version of Part 2, or a simple statement indicating that documents cannot be re-disclosed. 42 C.F.R. § 2.32.
  • A patient may now consent to disclosure to a category of persons who are "generally identified," not to only one identified person. 42 C.F.R. § 2.33.
  • When a patient consents to disclosure for payment or health care operations, a lawful holder may disclose the covered information to contractors, subcontractors, or legal representatives for payment or health care operations purposes (not for purposes of diagnosis, treatment, or referrals). However, the lawful holder must comply with certain requirements. A lawful holder making such a disclosure must have a contract in place with the contractor, subcontractor, or legal representative requiring compliance with Part 2, and must provide notice regarding re-disclosure in accordance with § 2.32, require safeguards, and require reporting of unauthorized uses, disclosures or breaches. Further, the lawful holder may only disclose the necessary information for the contractor, subcontractor, or legal representative to perform its duties under the contract, and the contractor, subcontractor, or legal representative may not re-disclose to a third party except under certain specified circumstances. 42 C.F.R. § 2.33.
  • The provision regarding audits and investigations now applies not only to Part 2 programs, but also to lawful holders. It now also allows an individual or entity that provides financial assistance to a Part 2 program or other lawful holder and that is a third-party payer covering patients in the Part 2 program, or is such individual's or entity's quality improvement organization performing a review, to review patient identifying information. Similarly, an individual or entity conducting a Medicare, Medicaid, or CHIP audit or evaluation may disclose information to its contractor, subcontractor, or legal representative for purposes of the audit or evaluation. 42 C.F.R. § 2.53.

The revisions therefore clarify how Part 2 affects Part 2 programs and other lawful holders, while ensuring the confidentiality of patient information.

Download a PDF of Verrill Dana's redline of the recent revisions to the Confidentiality Requirements of Substance Use Disorder Patient Records regulations.

Firm Highlights


FDA Issues Guidance on IRB Review of Non-Emergency Individual Patient Expanded Access Requests for Investigational Drugs and Biological Products to Treat COVID-19

Prompted by a substantial increase in requests for individual patient access to investigational drugs and biologics to treat COVID-19, the U.S. Food & Drug Administration (“FDA”) issued guidance on June 2, 2020 that outlines...


News Flash: HHS Issues Statement Removing Premarket Review Requirements for Laboratory Developed Tests (“LDTs”), Including COVID-19 LDTs

What happened? On August 19, 2020, the U.S. Department of Health and Human Services (“HHS”) issued a single paragraph statement rescinding U.S. Food and Drug Administration (“FDA”) guidance documents concerning premarket review of Laboratory...


European Union GDPR—Institution

Counseled a preeminent health system and academic medical center on its compliance with the European Union General Data Protection Regulation (GDPR) in relation to its clinical and research activities, including its international research studies...


Conflicts of Interest

Reviewed medical center's systems, policies and procedures for identifying, assessing, and managing investigator and institutional conflicts of interest.


FDA Updates its Guidance on Conducting Clinical Trials During COVID-19 Public Health Emergency

On April 16, 2020, the U.S. Food & Drug Administration (“FDA”) again updated its guidance on the “Conduct of Clinical Trials of Medical Products during COVID-19 Public Health Emergency,” adding seven new questions and...


38 Verrill Attorneys, Across Four Offices, Recognized in 2020 Chambers & Partners Guide

(April 27, 2020) – Verrill has been rated as a Leading Firm in a total of ten categories and subcategories as evaluated by London-based Chambers & Partners , one of the world's most respected...


Nearly 80 Verrill Attorneys Recognized by Best Lawyers® 2021, Including a Dozen Named Lawyers of the Year

(August 24, 2020) – Nearly 80 Verrill attorneys were recognized as "Best Lawyers" by Best Lawyers® 2021 , including 12 attorneys named “Lawyer of the Year,” a distinguished recognition for only a single lawyer...


Michael K. Fee to Lead Verrill’s Nationally-Recognized Health Care and Life Sciences Practice Amidst Recent Changes

(August 31, 2020) – Verrill is pleased to announce Michael K. Fee as the new leader of Verrill’s nationally-recognized Health Care & Life Sciences Group. The Group has a long history of representing a...


Multi-Site Global Research

Developed and negotiated site and coordinating center agreements in connection with a multi-site, international, National Institutes of Health (NIH)-funded study, and advised on regulatory issues related to the conduct of the study and subsequent...


EU-U.S. Privacy Shield Invalidated: Does Your Company Have a Plan B?

On Thursday, July 16, 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield (“Privacy Shield”) in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (Case C-311/18...