Health Care Alert: SAMHSA Finalizes Changes to Confidentiality of Substance Use Disorder Patient Records Rule

Related Practices

Attorneys & Professionals

For the first time in nearly 30 years, the Substance Abuse and Mental Health Services Administration (SAMHSA) has updated the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (42 C.F.R. Part 2). On January 18, 2017, SAMHSA published the Final Rule amending 42 C.F.R. Part 2. The changes were set to be effective February 17, 2017, but as discussed in greater detail below, the effective date has been delayed until no sooner than March 21, 2017.

Background and Overview

Since the rules were last amended in 1987, significant changes have occurred within the U.S. health care delivery system — development of new models of integrated care, creation of an electronic infrastructure for managing and exchanging patient information, and a new focus on performance measurement. With these system changes, however, previously unconsidered issues have arisen relative to information exchange, and the attendant patient privacy and security concerns. The Final Rule is aimed at modernizing the substance use disorder patient record regulatory framework by balancing patient participation and benefit from these system delivery improvements, with ensuring robust confidentiality protection of sensitive patient information.

Summary of Important Changes in Final Rule

Compliance with many of the existing provisions of 42 C.F.R. Part 2 presents numerous operational challenges for substance use disorder treatment providers. Generally, 42 C.F.R. Part 2 prohibits any disclosure of identifiable patient data reflecting substance use treatment without the express written consent from the individual. Complying with this requirement often curtails information exchange, which is critical to continuity of patient care, as well as other legitimate clinical and operational functions. The Final Rule makes a number of modifications to the outdated regulatory scheme, many of which are targeted at facilitating information exchange while maintaining appropriate patient confidentiality protections.

Notable changes in the Final Rule include:

Along with the Final Rule, SAMHSA issued a supplemental notice of proposed rulemaking (SNPRM) to seek comment on additional clarifications. During the comment period for the Final Rule, SAMHSA received a number of questions concerning the existing restrictions on lawful holders and their contractors’ and subcontractors’ use and disclosure of data subject to 42 C.F.R. Part 2. As a result, SAMHSA is seeking further comments on a number of related proposals, including:

The SNPRM provides that comments on the proposed rule are due by February 17, 2017.

Looking Ahead

On January 20, 2017, the Trump administration issued a 60-day “regulatory freeze” on rules that have been published, but have yet to take effect. All executive department agencies were instructed to review “questions of fact, law, and policy” raised by such rules; where appropriate, they may also consider proposing for notice and comment a rule to delay the effective date beyond that 60-day period. As a result, the effective date for the Final Rule is delayed until no sooner than March 21, 2017. It remains unclear whether the comments to the SNPRM are likewise delayed.

Assuming the Final Rule is implemented, providers subject to 42 C.F.R. Part 2 need to take action. With a seemingly short amount of time to digest and implement these changes, much work needs to be done. Providers will need to revise their consent documents and prohibition on re-disclosure statements, as well as review and update their security policies and procedures. Policies regarding permitted disclosures should be revisited. And with the change to the QSO definition, now is a great time to inventory all vendors to ensure each is being appropriately categorized as a QSO, and that all appropriate contractual documentation is in place.

We will continue to monitor the effective date of the Final Rule, in addition to any other regulatory changes that might occur. If you have any questions on these changes to 42 C.F.R. Part 2 and how they might impact your operations, or would like assistance with implementing any of the new provisions, please contact your Vorys health care attorney.