CLIENT ADVISORY: New SAMHSA Rules on Substance Use Treatment Record Disclosure Released

On January 18, 2017, the Substance Abuse and Mental Health Services Administration (SAMHSA) published a Final Rule that revises the requirements for the disclosure of substance use disorder patient records. Barring intervention by the Trump administration, the Final Rule will go into effect on February 17, 2017. Comments on a supplemental Proposed Rule are due the same day.

The Confidentiality of Substance Use Disorder Patient Records regulations had not been updated since 1987 and the new regulations are intended to better align with “the U.S health care delivery system while retaining important privacy protections.”[1] The stated purpose of the new SAMHSA Rule is to ensure that substance use disorder patients can benefit from the technological advances that have facilitated the integration of healthcare and the development of new healthcare models.[2] The Final Rule will require changes to consent forms currently in use for disclosure of substance use disorder diagnosis and treatment and an understanding of new record keeping requirements.

The regulations continue to apply to federally assisted programs that provide substance use disorder diagnosis and treatment, and are more stringent than HIPAA’s requirements for non-substance use disorder records. SAMHSA expanded the restriction on re-disclosures to include anyone who receives patient records from a Part 2 program, and any other lawful holder of patient identifying information who is aware of the restriction on re-disclosures. [3] The Final Rule revises several provisions, which are listed and discussed below.

1. Consent requirements (§2.31)
   1. The Final Rule purports to streamline the consent process to disclose a patient’s substance use disorder records. Under the old rules, a patient wishing to consent to the disclosure of substance use disorder records to another individual or entity had to specifically name the individual or entity in a signed consent. The Final Rule streamlines the process somewhat by allowing a patient to make a “general designation” in the “To Whom” section of their written consent in certain circumstances. Thus, one consent may be used to disclose records to multiple individuals or entities. Patients, however, are not required to use a general designation and may limit disclosures by making a designation to a specific individual or entity on the consent form.
   2. The new general designation is only valid if the individual or entity receiving the general disclosure has a treating provider relationship with the patient. Furthermore, a general designation is only appropriate if the consent form includes a statement that the patient understands they may request a list of entities to which their information has been disclosed as part of the general designation.[4] Thus, providers must update consent forms and related documentation practices to be compliant with the new Final Rule, but it may be more confusing to patients and providers.

2. Confidentiality restrictions and safeguards (§2.13)
   1. The new rule imposes a new recordkeeping requirement for providers that maintain substance use disorder records. Upon a patient’s request, a health care provider must furnish a list of entities to which the patient’s information has been disclosed within the previous two years. The disclosure list requirement only applies when the patient provided consent to a general designation. The patient’s request for a list of disclosures must be made in writing.[5] This new recordkeeping requirement will impose an additional burden on health care providers that take advantage of the new general designation option for consent forms.

3. Prohibition on re-disclosure (§2.32)
   1. The Final Rule requires changes to the language used on the notice that is required to accompany any disclosures of substance use disorder records. The new language was included to clarify that the prohibition only applies to information that could identify an individual as “having been diagnosed, treated, or referred for treatment for a substance use disorder . . . .”[6] Furthermore, the language clarifies that the information cannot be used to criminally investigate or prosecute a patient with a substance use disorder.[7]

4. Research (§2.52)
   1. The Final Rule relaxes requirements related to the use of substance use disorder records in research. The amended provision specifies that patient identifying information may be disclosed to a HIPAA-covered entity or business associate, if the patient has consented. The patient information may also be disclosed to an entity for research purposes if the entity is subject to HHS regulations regarding the protection of human subjects.
   2. In return for permission to use certain records in research, the Final Rule requires that (1) there be no re-disclosure of the information; (2) the part 2 data only be included in reports in the aggregate; (3) the researcher maintain and destroy the information in accordance with security policies; (4) and the researcher maintain records in accordance with the applicable record retention laws.
   3. The Final Rule also includes a provision governing data linkages. Data linkages allow researchers to access data sets from federal data repositories. This provision was included to open up data streams and encourage new research opportunities. For example, researchers will be able to study the longitudinal effects of patient treatments.[8] An individual or entity wishing to link data from a data repository must request permission and obtain approval from an Institutional Review Board registered with the Department of Health and Human Services. Furthermore, the information obtained from the data linkage cannot be provided to law enforcement agencies or officials.[9]

5. Qualified service organization (§2.11)
   1. A qualified service organization (QSO) is an entity or an individual that provides services to a Part 2 program and can receive patient information from a Part 2 program without patient consent. The Final Rule expands the definition of a QSO; therefore, expanding the services that a Part 2 program can receive from a QSO. SAMHSA revised the definition to include population health management as a service that a QSO can provide. The new definition also includes medical staffing as a service. The term “medical staffing” was specifically included to emphasize that a QSO should not be used as a method of avoiding the requirement of obtaining patient consent.[10]

6. Security for records (§2.16)
   1. The Final Rule imposes new recordkeeping requirements for providers who keep patient identifying information in an electronic format. This provision was revised to account for the growing use of electronic health record systems. Part 2 programs and other lawful holders of patient identifying information will have to require the destruction of any hard copy media by sanitizing the media. They will also have to require anyone receiving or transmitting patient identifying information in an electronic format to remove the identifiable information. [11]

7. Audit and evaluation (§2.53)
   1. The Final Rule permits the Part 2 program to determine who is qualified to conduct an audit or evaluation of the program. The former rules only permitted a program director to make the determination.
   2. A part 2 program may disclose patient identifying information to any individual or entity for the purposes of conducting an audit to meet the requirements for Medicare & Medicaid (CMS) – regulated accountable care organizations (CMS-regulated ACO). The Final Rule specifically addresses CMS-regulated ACO evaluations and audits in an effort to better align with the criteria set forth in the Affordable Care Act. Any ACO or CMS-regulated organization that is subject to an evaluation or audit, or that is performing the evaluation or audit, must have a signed Participation Agreement with CMS. The agreement ensures the protection of patient identifying information.
   3. Moreover, a Part 2 program must ensure the secure copying, removal, downloading, and forwarding of patient records for the purposes of an evaluation or audit. This entails ensuring that the individual or entity receiving the records agrees in writing to properly disposing of patient identifying information. This includes sanitizing any hard copy media. Additionally, the individual has to agree to retain records in compliance with the applicable retention law, and comply with limitations on disclosure.

The Final Rule left in place existing disclosure rules for substance use disorder treatment records used in civil or criminal proceedings, requiring in camera or other confidential reviews before release.[12] Should you or your organization have any questions regarding implementation of this Final Rule, please contact Peter Mellette or Harrison Gibbs at Mellette PC at (757) 259-9200.

This Client Advisory is for general educational purposes only. It is not intended to provide legal advice specific to any situation you may have. Individuals desiring legal advice should consult legal counsel for up-to-date and fact-specific advice.

[1] 82 Fed. Reg. 6052, 6053 (Jan. 18, 2017).

[2] Id.

[3] 82 Fed. Reg. 6052, 6117 (Jan. 18, 2017) (to be codified at 42 C.F.R. §2.12).

[4] 82 Fed. Reg. 6052, 6121 (Jan. 18, 2017) (to be codified at 42 C.F.R. §2.31).

[5] 82 Fed. Reg. 6052, 6118 (Jan. 18, 2017) (to be codified at 42 C.F.R. §2.13).

[6] 82 Fed. Reg. 6052, 6070 (Jan. 18, 2017).

[7] 82 Fed. Reg. 6052, 6122 (Jan. 18, 2017) (to be codified at 42 C.F.R. §2.32).

[8] Katie Tipping, Proposed Rule Updating the Substance Abuse Confidentiality Regulations (42 CFR Part 2), SAMHSA, https://www.samhsa.gov/sites/default/files/topics/health_info_tech/42-cfr-part-2-proposed-rule-webinar-slides.pdf.

[9] 82 Fed. Reg. 6052, 6123 (Jan. 18, 2017) (to be codified at 42 C.F.R. §2.52).

[10] 82 Fed. Reg. 6052, 6116 (Jan. 18, 2017) (to be codified at 42 C.F.R. §2.11); 82 Fed. Reg. 6052, 6066.

[11] 82 Fed. Reg. 6052, 6120 (Jan. 18, 2017) (to be codified at 42 C.F.R. §2.16).

[12] 82 Fed. Reg. 6052, 6120 (Jan. 18, 2017) (to be codified at 42 C.F.R. §2.64).