Redline of Recent Revisions to the Confidentiality of Substance Use Disorder Patient Records Regulations
On January 2, 2018, the Substance Abuse and Mental Health Services Administration ("SAMHSA") published revisions to 42 C.F.R. Part 2, Confidentiality of Substance Use Disorder Patient Records ("Part 2"). SAMHSA indicated that the changes were "intended to better align the regulations with advances in the U.S. health care delivery system while retaining important protections for individuals seeking treatment for substance use disorders."
The revisions, effective as of February 2, 2018, reflect the operational realities of the current health care delivery system, such as the rise in integrated health settings. Notable highlights include:
- The required statement regarding re-disclosure may now be either the lengthy statement from the prior version of Part 2, or a simple statement indicating that documents cannot be re-disclosed. 42 C.F.R. § 2.32.
- A patient may now consent to disclosure to a category of persons who are "generally identified," not to only one identified person. 42 C.F.R. § 2.33.
- When a patient consents to disclosure for payment or health care operations, a lawful holder may disclose the covered information to contractors, subcontractors, or legal representatives for payment or health care operations purposes (not for purposes of diagnosis, treatment, or referrals). However, the lawful holder must comply with certain requirements. A lawful holder making such a disclosure must have a contract in place with the contractor, subcontractor, or legal representative requiring compliance with Part 2, and must provide notice regarding re-disclosure in accordance with § 2.32, require safeguards, and require reporting of unauthorized uses, disclosures or breaches. Further, the lawful holder may only disclose the necessary information for the contractor, subcontractor, or legal representative to perform its duties under the contract, and the contractor, subcontractor, or legal representative may not re-disclose to a third party except under certain specified circumstances. 42 C.F.R. § 2.33.
- The provision regarding audits and investigations now applies not only to Part 2 programs, but also to lawful holders. It now also allows an individual or entity that provides financial assistance to a Part 2 program or other lawful holder and that is a third-party payer covering patients in the Part 2 program, or is such individual's or entity's quality improvement organization performing a review, to review patient identifying information. Similarly, an individual or entity conducting a Medicare, Medicaid, or CHIP audit or evaluation may disclose information to its contractor, subcontractor, or legal representative for purposes of the audit or evaluation. 42 C.F.R. § 2.53.
The revisions therefore clarify how Part 2 affects Part 2 programs and other lawful holders, while ensuring the confidentiality of patient information.