SAMHSA updates rules on the sharing of identifiable substance use disorder patient information

January 19, 2017

Health Care Alert

This alert was co-authored by Nesko Radovic.

On January 18, 2017, the Substance Abuse and Mental Health Services Administration (SAMHSA) published its final rule (the Final Rule) implementing changes to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations at 42 CFR Part 2 (Part 2). The modifications under the Final Rule, which include changing the Part 2 name to “Confidentiality of Substance Use Disorder Patient Records,” are intended to align the protections provided to patients with substance use disorders (SUDs) with new health care delivery models that promote health integration and information exchange.


The purpose of Part 2 is to encourage individuals to seek treatment for SUDs by providing enhanced privacy protections for SUD records in order to shield those individuals from prosecution or discrimination associated with substance abuse. Recognizing significant policy and technological advances experienced by the health care system since the last substantive revisions to Part 2 in 1987, SAMHSA issued a Notice of Proposed Rule Making (NPRM) in February 2016, soliciting stakeholder comments on proposed changes to Part 2 intended to more accurately reflect this evolving health care environment. The resulting Final Rule modernizes Part 2 by addressing the current health care delivery system, promoting health integration and facilitating appropriate research and data exchange activities.

Key modifications to Part 2 under the Final Rule are summarized below:

  • Consent Requirements/Information to be Disclosed—The Final Rule modified the requirements for a valid patient consent for disclosure. The consent must explicitly describe the SUD-related information to be disclosed, and must have sufficient specificity to allow the disclosing program or other entity to comply with the request. However, SAMHSA noted that the Final Rule does not prohibit the consent providing the option to disclose “all my substance use disorder information” as long as the consent provides granular options as well.
  • Consent Requirements/Recipients of Information—The Final Rule allows a patient to consent to the disclosure of his or her information to individuals or entities using a general designation in the “To Whom” section, provided that those individuals or entities have a treatment relationship with the patient (i.e., to “my treating providers”). This change is intended to allow for broader disclosure of the patient’s information so that patients may participate in and benefit from integrated health care systems. However, if the Part 2 program permits the use of a general designation, it must have a mechanism in place that will allow it to determine whether a treating provider exists. The consent form also must notify a patient using a general designation in the ‘‘To Whom’’ section that he or she has the right to obtain, upon request, a list of disclosures.
  • Research—Lawful holders of Part 2 patient identifying information (i.e., individuals or entities that have received patient identifying information pursuant to a patient consent) will be allowed to disclose the information to qualified personnel for the purpose of scientific research provided that such personnel meet specified regulatory requirements. In addition, approved researchers will be permitted to link to data sets from federal data repositories holding Part 2 data if the research project, including a data protection plan, has been reviewed and approved by a registered institutional review board. These modifications under the Final Rule are intended to open up new research opportunities.
  • Electronic Signatures—The Final Rule clarifies that consent may be made by electronic signatures, unless otherwise prohibited by law.
  • Limitations on Re-disclosure—The Final Rule clarifies that the prohibition on re-disclosure of SUD records only applies to information that identifies, directly or indirectly, an individual as having been diagnosed, treated or referred for treatment for a substance use disorder, but other health-related information may be shared by the Part 2 program to be re-disclosed, if permissible under the applicable law.
  • Medical Emergency Exception —The revised medical emergency exception to the Part 2 consent requirement gives providers more discretion to determine when a “bona fide medical emergency” exists, thus allowing disclosure of patient identifiable information without patient consent.
  • Audit and Evaluation—The Final Rule updates audit and evaluation procedures to meet the requirements of CMS-regulated Accountable Care Organizations (ACOs) or similar CMS-regulated organizations (including CMS-regulated Qualified Entities). This change will ensure that CMS can perform necessary audit and evaluations activities, including financial and quality assurance functions critical to ACOs and other health care organizations.
  • Security for Records—The Final Rule updated Part 2 to address both paper and electronic documentation, and requires providers to implement formal policies and procedures addressing security of SUD records, including sanitation of associated media. The Final Rule also addresses disposition of records from discontinued programs.
  • Reports of Violations—Under the Final Rule, reports of violations of Part 2 by methadone programs (now referred to as opioid treatment programs) are to be made to SAMHSA, rather than the Food and Drug Administration (FDA) because authority over those programs was transferred from the FDA to SAMHSA in 2001.

The Final Rule is effective as of February 17, 2017, and is available in the Federal Register.

Additional guidance

According to SAMHSA’s commentary in the Final Rule, a significant number of stakeholders submitted comments seeking additional clarity on issues that were outside of the scope of the proposed rules in the initial NPRM. SAMHSA indicated throughout the Final Rule that it may issue subregulatory guidance on a number of topics, including the re-disclosure provisions, the medical emergency exception to the consent requirement and the application of the audit and evaluation rules.

In addition, SAMHSA issued a Supplemental Notice of Proposed Rulemaking (SNPRM) concurrently with the Final Rule to address these concerns, particularly in connection with the role of contractors, subcontractors and legal representatives in the health care system with respect to payment and health care operations.

Provisions being proposed in the SNPRM include:

  • Clarifying and limiting circumstances in which disclosures to contractors, subcontractors and legal representatives of lawful holders may receive and utilize Part 2 data for reimbursement and health care operations activities.
  • Proposing an abbreviated alternative statement for the notice to accompany disclosures.
  • A new provision outlining ACOs’ use of contractors, subcontractors and legal representatives to carry out audits and evaluation activities required by CMS.

The SNPRM comment period will be open until 5:00 p.m. on February 17, 2017, and comments can be posted here. The SNPRM can be found at

The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.

Back to top