Proposed Changes to Part 2 Rules Ease Substance-Use Disorder Record Sharing

27 August 2019 Health Care Law Today Blog
Author(s): Adam J. Hepworth Jennifer J. Hennessy Claire Marblestone

Recently proposed changes to the federal regulations governing the confidentiality of substance-use disorder patient records (Part 2) would all but eliminate the most significant and intractable barrier to sharing protected information under Part 2 with patient consent. The proposed rule does not contemplate changing the basic principle under Part 2 that generally requires patient consent for disclosures other than for a bona fide medical emergency, research, audits, or program evaluations, or when based on an appropriate court order. The Substance Abuse and Mental Health Services Administration (SAMHSA) also published an accompanying fact sheet with a user-friendly summary of the proposed changes and the purposes behind them.  

Background on Part 2 Data Sharing

For years, Part 2’s rigorous consent requirements have made it extremely challenging for Part 2 programs to share information, even in circumstances when patients wanted them to do so. The rule has required—in most circumstances—that a valid consent specify by name the individual to whom a disclosure may be made. Covered programs have largely viewed this requirement as operationally impossible to implement and complained that it necessitates the total exclusion of substance-use disorder information from care coordination and benefits programs that patients have affirmatively opted into. 

Although recent changes in 2017 relaxed Part 2’s consent requirements when patients authorize disclosures to treating providers, the rule has remained a significant barrier to information sharing in contexts beyond treatment. In its proposed rule, SAMHSA would amend the regulation to allow written consents to identify the name of the individual or the name of the entity that may receive the information. Consents authorizing disclosure to health information exchanges and research institutions would need to include the name of specific individuals or entities beyond the health information exchange or research institution itself (but would still be allowed to use a general designation limited to treating providers). 

Expanding the Scope of Permissible Data Sharing

SAMHSA explained that the consent change is intended to effectuate the wishes of patients who may want Part 2 programs “to disclose protected information to entities for reasons including eligibility determinations and seeking non-medical services or benefits from governmental and non-governmental benefits.” Beyond those specifically identified goals, the revision would facilitate consent-based information sharing for a range of programs or services that go beyond medical treatment. This simple proposal could fundamentally restructure the information-sharing landscape.

The rule also includes several other noteworthy proposed changes. On a similar theme of loosening the most restrictive aspects of Part 2, SAMHSA has proposed amending the definition of “record” to clarify that entities and individuals who are not covered by Part 2 need only apply confidentiality protections to the specific Part 2 record they receive from covered programs.  If all of its changes were finalized, the proposed rule would result in a kind of safe harbor for non-covered entities that segregate Part 2 records they receive, ensuring that such non-covered entities need not fear that their own records (which may include identical substance-use disorder information) suddenly become subject to Part 2’s onerous requirements.  As part of this effort, new language would state that “information conveyed orally by a part 2 program to a non-part 2 provider for treatment purposes with the consent of the patient does not become a record subject to this part in the possession of the non-part 2 provider merely because that information is reduced to writing by that non-part 2 provider.”

Health Care Operation and Payment Disclosures

In addition, the proposed rule would revise the regulation governing disclosures that may be made to contractors with written consent to include a non-exhaustive list of 17 activities that are considered “payment” or “health care operations” under Part 2.  Part 2 does not currently define “payment” or “health care operations.”  SAMHSA included 17 “illustrative examples” of such activities in the preamble to a 2018 rule.  Since these activities were not included in the text of the final rule, many Part 2 providers believed that such activities were not permissible payment or health care operation activities under the rule. The proposed rule would move those 17 activities into the regulation itself, but SAMHSA continues to stress that the list is not intended to be exhaustive. Notably, the 2018 rule, as well as this proposed rule, intentionally exclude care coordination and case management in the list of activities, even though care coordination and case management are part of HIPAA’s definition of “health care operations.”

Interested parties will have until October 25, 2019 to provide comments on the proposed rule.

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.

Related Services