April 13, 2021

Volume XI, Number 103


April 12, 2021

Subscribe to Latest Legal News and Analysis

Patient Records: Part 2 Final Rule Reduces Substance Use Disorder Record Sharing Barriers

On July 15, 2020, a final rule revising the federal regulations governing the Confidentiality of Substance Use Disorder Patient Records (also known as 42 C.F.R. Part 2 or Part 2) was published. The revised rule will implement many of the changes to the federal regulations proposed last year. The basic principle underlying these changes is to maintain privacy protections for individuals seeking treatment for substance use disorders (SUDs), while facilitating better coordination of care in response to the opioid epidemic. The Substance Abuse and Mental Health Services Administration (SAMHSA) also published an accompanying fact sheet with a user-friendly summary of the changes and the purposes behind them.

Of note, this revised rule does not include the anticipated changes to Part 2 under the regulations implementing the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which will further modify several of the amendments adopted in this final rule. The changes in the final rule will serve as interim and transitional standards, until regulations under the CARES Act are finalized.

Changes to Encourage Information Sharing for Care Coordination

For years, Part 2’s rigorous consent requirements have served as a barrier for substance use disorder treatment programs, as defined under the Part 2 regulations (Part 2 Programs), to share information, even in circumstances when patients wanted them to do so. Part 2 has required that a valid consent specify the name of the individual to whom a disclosure may be made, subject to certain exceptions such as disclosures to treating providers and third-party payers. Even if a SUD patient wished to authorize disclosure of her information to an organization, such as a local sober living program, Part 2 required that the authorization list the name of the individual receiving the patient’s information at the sober living facility.

Part 2 Programs have largely viewed this requirement as operationally impossible to implement and complained that it necessitates the total exclusion of SUD information from care coordination and benefits programs into which patients have affirmatively opted.. Although recent changes in 2017 relaxed Part 2’s consent requirements when patients authorize disclosures to treating providers, Part 2 has remained a significant barrier to information sharing in contexts beyond treatment. These most recent revisions to the rule now allow patients to consent to the disclosure of their information without naming a specific individual to receive this information on behalf of a given entity, allowing the written consent to identify “The name(s) of the individual(s) or the name(s) of the entity(-ies) to which a disclosure is to be made.”

The revised rule also includes several other noteworthy changes to encourage information sharing. To facilitate coordination of care activities by providers outside of a Part 2 Program (non-Part 2 Providers), SAMHSA revised the definition of “records” to clarify that entities and individuals who are not covered by Part 2 need only apply confidentiality protections to the specific Part 2 record they receive from a Part 2 Program. This creates a safe harbor for non-Part 2 Providers that segregate Part 2 records they receive, ensuring that such non-Part 2 Providers need not fear that their own records suddenly becomes subject to Part 2’s requirements. The revised rule also provides that information conveyed orally by a Part 2 Program to a non-Part 2 Provider for treatment purposes with patient consent “does not become a record subject to [Part 2] in the possession of the non-[P]art 2 provider merely because that information is reduced to writing by that non-[P]art 2 provider.”

Disclosures During Medical Emergencies Expanded

Prior to these revisions, Part 2 permitted disclosures to medical personnel without patient consent only to the extent necessary to meet a bona fide medical emergency in which the patient's prior informed consent cannot be obtained. The revised rule now also allows for disclosures to medical personnel without patient consent to the extent necessary to meet “a bona fide medical emergency in which a [P]art 2 program is closed and unable to provide services or obtain the prior written consent of the patient, during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time that the [P]art 2 program resumes operations.” SAMHSA expanded the information sharing permitted during emergencies because emergency situations often disrupt a patient’s access to their usual SUD treatment services—as the COVID-19 public health emergency has plainly illustrated—which can lead to patients seeking treatment with providers who do not have full access to their records. During such an emergency, adherence to normal policies and procedures for obtaining patient consent to share information for treatment purposes may not be feasible.

Disclosures for Payment and Health Care Operations

The revised rule also updates the regulation governing re-disclosures of SUD records by a contractor for the contractor’s payment and health care operations purposes. In 2018, Part 2 was revised to permit contractors that receive SUD records via patient consent for payment and/or health care operations purposes to re-disclose those records to subcontractors that carry out payment and/or health care operations functions for the contractor. At the time, Part 2 did not define “payment” and “health care operations” other than in the preamble to the 2018 rule (which excluded care coordination from the examples of payment and health care operations). The list of 18 examples is now expressly included in the regulation text itself and largely align with HIPAA’s definition of the terms “payment” and “health care operations,” including care coordination and case management services in the definition.

While these changes will be considered a step in the right direction by many, industry members will still be looking for the additional CARES Act changes to the Part 2 regulations and overall additional flexibilities which would align Part 2 more closely with HIPAA. Foley & Lardner will continue to monitor developments in this area.

The revisions to Part 2 are effective on August 15, 2020.

© 2021 Foley & Lardner LLPNational Law Review, Volume X, Number 197



About this Author

Jennifer Hennessy, Foley Lardner Law Firm, Privacy Security and Healthcare Attorney

Jennifer J. Hennessy is a privacy and security and health care regulatory attorney with Foley & Lardner LLP. Her practice includes advising businesses on compliance with state and federal data privacy and security laws. She assists covered entities and business associates in complying with the HIPAA Privacy and Security Rules, and also advises businesses and individuals on compliance with state data privacy laws and federal law 42 C.F.R. Part 2, Confidentiality of Alcohol and Drug Abuse Treatment Records. She frequently guides clients through data incident management...

Adam Hepworth,  Health Care Attorney, Foley Law Firm

Adam J. Hepworth is an associate and health care business lawyer with Foley & Lardner LLP. He is a member of the firm’s Health Care Industry Team.

Prior to joining Foley, Mr. Hepworth was a law clerk for Judge Harris L. Hartz on the United States Court of Appeals for the Tenth Circuit. He also interned in the San Francisco City Attorney’s health group and externed in the Civil Division of the United States Attorney’s Office in San Jose. Before he attended law school he was a policy intern for Sierra Health Foundation, where he worked on...

Sunny Levine Health Care Lawyer Foley Lardner

Sunny J. Levine is a health care lawyer with Foley & Lardner LLP, and member of the firm’s Telemedicine & Digital Health and Health Care Industry Teams working with hospitals and health systems, physician practice groups, and technology companies across the country. Sunny’s practice focuses on federal and state regulatory compliance and business issues in the health care industry. She also works with companies offering highly regulated consumer products, such as medical marijuana and alcohol beverages.

Telemedicine & Digital Health Experience

Sunny’s practice...

Emily Wein Health Care Lawyer
Of Counsel

Emily H. Wein is of counsel and a health care lawyer with Foley & Lardner LLP, and member of the firm’s national Telemedicine & Digital Health Industry Team. Emily understands and identifies with the business and strategic goals of virtual care and digital health companies. She delivers practical legal guidance molded to accomplish each individual client’s unique operational goals. Emily works with a diverse bench of organizations – including large interdisciplinary hospital systems, skilled nursing facilities, multi-state clinical practices, and fast-moving entrepreneurs. Emily’s...