Patient Records: Part 2 Final Rule Reduces Substance Use Disorder Record Sharing Barriers

15 July 2020 Health Care Law Today Blog
Authors: Jennifer J. Hennessy Adam J. Hepworth Sunny J. Levine

On July 15, 2020, a final rule revising the federal regulations governing the Confidentiality of Substance Use Disorder Patient Records (also known as 42 C.F.R. Part 2 or Part 2) was published. The revised rule will implement many of the changes to the federal regulations proposed last year. The basic principle underlying these changes is to maintain privacy protections for individuals seeking treatment for substance use disorders (SUDs), while facilitating better coordination of care in response to the opioid epidemic. The Substance Abuse and Mental Health Services Administration (SAMHSA) also published an accompanying fact sheet with a user-friendly summary of the changes and the purposes behind them.


Of note, this revised rule does not include the anticipated changes to Part 2 under the regulations implementing the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which will further modify several of the amendments adopted in this final rule. The changes in the final rule will serve as interim and transitional standards, until regulations under the CARES Act are finalized.

Changes to Encourage Information Sharing for Care Coordination

For years, Part 2’s rigorous consent requirements have served as a barrier for substance use disorder treatment programs, as defined under the Part 2 regulations (Part 2 Programs), to share information, even in circumstances when patients wanted them to do so. Part 2 has required that a valid consent specify the name of the individual to whom a disclosure may be made, subject to certain exceptions such as disclosures to treating providers and third-party payers. Even if a SUD patient wished to authorize disclosure of her information to an organization, such as a local sober living program, Part 2 required that the authorization list the name of the individual receiving the patient’s information at the sober living facility.

Part 2 Programs have largely viewed this requirement as operationally impossible to implement and complained that it necessitates the total exclusion of SUD information from care coordination and benefits programs into which patients have affirmatively opted.. Although recent changes in 2017 relaxed Part 2’s consent requirements when patients authorize disclosures to treating providers, Part 2 has remained a significant barrier to information sharing in contexts beyond treatment. These most recent revisions to the rule now allow patients to consent to the disclosure of their information without naming a specific individual to receive this information on behalf of a given entity, allowing the written consent to identify “The name(s) of the individual(s) or the name(s) of the entity(-ies) to which a disclosure is to be made.”

The revised rule also includes several other noteworthy changes to encourage information sharing. To facilitate coordination of care activities by providers outside of a Part 2 Program (non-Part 2 Providers), SAMHSA revised the definition of “records” to clarify that entities and individuals who are not covered by Part 2 need only apply confidentiality protections to the specific Part 2 record they receive from a Part 2 Program. This creates a safe harbor for non-Part 2 Providers that segregate Part 2 records they receive, ensuring that such non-Part 2 Providers need not fear that their own records suddenly becomes subject to Part 2’s requirements. The revised rule also provides that information conveyed orally by a Part 2 Program to a non-Part 2 Provider for treatment purposes with patient consent “does not become a record subject to [Part 2] in the possession of the non-[P]art 2 provider merely because that information is reduced to writing by that non-[P]art 2 provider.”

Disclosures During Medical Emergencies Expanded

Prior to these revisions, Part 2 permitted disclosures to medical personnel without patient consent only to the extent necessary to meet a bona fide medical emergency in which the patient's prior informed consent cannot be obtained. The revised rule now also allows for disclosures to medical personnel without patient consent to the extent necessary to meet “a bona fide medical emergency in which a [P]art 2 program is closed and unable to provide services or obtain the prior written consent of the patient, during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time that the [P]art 2 program resumes operations.” SAMHSA expanded the information sharing permitted during emergencies because emergency situations often disrupt a patient’s access to their usual SUD treatment services—as the COVID-19 public health emergency has plainly illustrated—which can lead to patients seeking treatment with providers who do not have full access to their records. During such an emergency, adherence to normal policies and procedures for obtaining patient consent to share information for treatment purposes may not be feasible.

Disclosures for Payment and Health Care Operations

The revised rule also updates the regulation governing re-disclosures of SUD records by a contractor for the contractor’s payment and health care operations purposes. In 2018, Part 2 was revised to permit contractors that receive SUD records via patient consent for payment and/or health care operations purposes to re-disclose those records to subcontractors that carry out payment and/or health care operations functions for the contractor. At the time, Part 2 did not define “payment” and “health care operations” other than in the preamble to the 2018 rule (which excluded care coordination from the examples of payment and health care operations). The list of 18 examples is now expressly included in the regulation text itself and largely align with HIPAA’s definition of the terms “payment” and “health care operations,” including care coordination and case management services in the definition.

While these changes will be considered a step in the right direction by many, industry members will still be looking for the additional CARES Act changes to the Part 2 regulations and overall additional flexibilities which would align Part 2 more closely with HIPAA. Foley & Lardner will continue to monitor developments in this area.

The revisions to Part 2 are effective on August 15, 2020.

For more information, please contact your Foley relationship partner or the Foley colleagues listed below.

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.

Related Services