Final regulations on substance use disorder patient information offer notification flexibility and require certain contractual updates



January 05, 2018

Health Care Alert

Author(s): Laurie T. Cohen, Jena M. Grady, Valerie Breslin Montague

The Substance Abuse and Mental Health Services Administration (SAMHSA) has issued a final rule (the “Rule”) implementing changes to the Confidentiality of Substance Use Disorder Patient Records regulations at 42 C.F.R. Part 2 (“Part 2”), which 1) provides an abbreviated notice that Part 2 providers may use for information disclosures made with a patient’s consent; 2) clarifies the permitted disclosures of Part 2 patient identifying information to contractors, subcontractors and legal representatives who are engaged to assist with certain payment and health care operations activities; and 3) addresses permitted disclosures for purposes of carrying out audit and evaluation functions. The new Rule further amends the Part 2 regulations that were the subject of significant rulemaking published in January 2017.

In issuing the new Rule, SAMHSA indicated that it was seeking to align the Part 2 regulations with HIPAA to the extent possible. SAMHSA, however, emphasized that Part 2 provides stricter privacy protections than HIPAA in order to protect individuals with substance use disorders from discrimination and other legal exposure that might result from unauthorized use or disclosure of their Part 2 program records.

This Rule may not be the end of SAMHSA’s regulatory attempts to align Part 2 more closely with the HIPAA requirements, as SAMHSA has indicated that it will be engaging in discussions with stakeholders to determine the impact of the Part 2 regulations on patient care, privacy and health outcomes.

Notice regarding prohibition on re-disclosure

The Part 2 regulations have long required a notice of the prohibition on re-disclosing information when the disclosure was made with the patient’s written consent. Modified slightly from its proposal in the Supplemental Notice of Proposed Rulemaking (SNPRM), which was issued in January 2017, SAMHSA adopts an abbreviated notice, allowing it to fit within the character limitations some electronic health record programs place in the free-text space. SAMHSA believes that the changes made from the SNPRM make the notification more explicit that improper use or disclosure is prohibited, with the notice stating that “Federal [L]aw/42 CFR part 2 prohibits unauthorized disclosure of these records.” SAMHSA chose not to limit the circumstances in which this abbreviated notice can be used. In its preamble to the Final Rule, SAMHSA encourages lawful holders that use the abbreviated notice to also discuss the Part 2 protections with the recipients of the information.

Disclosures for payment and health care operations

The Final Rule also addresses disclosures of patient information from lawful holders to contractors or subcontractors for payment and health care operations purposes. SAMHSA finalizes its proposal to require a contractual provision addressing Part 2 compliance. It moves a proposed list of these payment and health care operations purposes from the regulatory text, as proposed in the SNPRM, to the preamble. Rather than a limited set of purposes, this change provides greater flexibility to lawful holders, particularly given what the preamble refers to as the “rapid changes occurring in the health care payment and delivery system.” SAMHSA also clarifies that lawful holders may not disclose identifiable patient information to contractors, subcontractors or legal representatives for the purposes of diagnosis, treatment or referral, stating that it desires that patients choose to disclose their information to those clinicians with whom they have direct contact.

With respect to the specifics of the contractual provisions, the Rule does not adopt the SNPRM proposal that the contract must describe the contractor’s/subcontractor’s/legal representative’s permitted uses of patient information. SAMHSA also defers to the holder of the information and the contractor/subcontractor to determine how to word the contractual language.

SAMHSA acknowledges the burden of updating contracts to comply with these requirements and allows lawful holders two years from the Rule’s effective date to update contracts with contractors, subcontractors and legal representatives.

Disclosures for audit and evaluation purposes

The Rule clarifies that patient identifying information may be disclosed without patient consent to contractors, subcontractors or legal representatives on behalf of third-party payers or quality improvement organizations to conduct audits and evaluations. The Rule further clarifies that in the context of audits undertaken by Medicare, Medicaid or the Children’s Health Insurance Program, further disclosures may be made to contractors, subcontractors or legal representatives to carry out the audit or evaluation without patient consent. In response to concerns expressed by certain commenters that permitting disclosures to contractors, subcontractors or legal representatives without patient consent greatly expands the “universe of individuals and entities who may receive Part 2 program records” that could impact a patient health coverage or for risk adjustment and other reporting purpose, SAMHSA responded that the Rule clearly states that patient identifying information released to such contractors, subcontractors or legal representatives “may only be used to carry out an audit and evaluation purpose or to investigate or prosecute criminal or other activities, as authorized by a court order….”

Summary of other public comments

With SAMHSA’s previous regulations published on January 18, 2017, SAMHSA also issued a SNPRM concurrently with that final rule and requested public comments in part to discuss restrictions and safeguards for patient records as well as the impact of the regulations on the confidentiality and privacy of patient records and overall goals of Part 2. While SAMHSA received multiple comments and suggestions regarding proposed additional restrictions and safeguards for disclosures with respect to payment and health care operations as discussed above, SAMHSA determined at this time that existing restrictions and safeguards including but not limited to provisions protecting records in criminal and civil procedures and minimal necessary disclosure requirements for records were adequate.

Some commenters pointed out that the regulations providing newly permitted disclosures for payment and health care operations should also include the requirement that patients, in their consent form, receive notification that the release of their records could include not only the consented recipient but also the recipient’s contractors, subcontractors and legal representatives as necessary to carry out payment or health care operations purposes. SAMHSA indicated that it is contemplating future rulemaking for Part 2 and will review this recommendation at that time. SAMHSA also recognized commenters’ recommendations to add a mechanism to allow patients who have been negatively affected by a disclosure to be able to identify the source of the disclosure (e.g., patients receiving a list of disclosures) and strengthening patients’ right to file a grievance for improper disclosures. Commenters also emphasized the importance of preserving patient confidentiality and expressed concern about whether the permissible disclosures provided now by this Rule would lead in part to patients restricting their consents for Part 2 record disclosures in fear of their records being broadly used by record recipients and the receipt’s contractors and subcontractors. These recommendations/comments will also be reviewed by SAMHSA and taken under consideration at the time of future rulemaking.

As noted above, SAMHSA will hold a public meeting to obtain additional comments from stakeholders about the effect Part 2 has on patient privacy, health outcomes and patient care. SAMHSA plans to use this meeting as a way to identify the course of action for any future Part 2 rulemaking. SAMHSA will review the public comments, including those discussed above, during this public meeting. SAMHSA has tentatively scheduled the public meeting for January 31, 2018.[1]

Nixon Peabody’s previous alerts summarizing the SNPRM and prior changes to the Part 2 regulations are available here and here. The Rule can be found here.


  1. SAMHSA, “SAMHSA finalizes changes to clarify health privacy rules for people who seek substance use disorder treatment.” Available here. [Back to reference]

The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.

Back to top