Part 2 Rule Update Modernizes SUD Record Disclosure Regulations

On January 3, 2018 the Substance Use and Mental Health Services Administration (SAMHSA) published a final rule implementing new changes to the Confidentiality of Substance Use Disorder Patient Records, 42 C.F.R. part 2 (Part 2).

The Part 2 privacy regulations govern the confidentiality of substance use disorder (SUD) patient records which are maintained in connection with the performance of any federally assisted substance use disorder program (Part 2 Records). The final rule becomes effective February 2, 2018.

While the new rule maintains the fundamental prohibition on disclosure of Part 2 patient records without patient consent, it expands the ways in which Part 2 patient records may be shared and modernizes notice requirements to align with current healthcare information technology practices.

  • Disclosures of Part 2 records to subcontractors are now permitted for payment and healthcare operations with patient consent: When a patient consents to the disclosure of their Part 2 Records for purposes of payment or healthcare operations, the recipient listed on the consent form (Lawful Holder) may further disclose the Part 2 Records to the Lawful Holder’s contractors, subcontractors, or legal representatives (Contractors) as necessary to carry out the payment or health care operations purpose for the disclosure. Under this new rule, Lawful Holders are required to have a written contract in place by February 2, 2020, with certain provisions obligating the Contractors to be bound by, and in compliance with Part 2.
    • Although the new rule authorizes disclosures to Contractors for payment and healthcare operations, SAMHSA confirmed that disclosures to Contractors for other purposes, such as diagnosis, treatment, or referral for treatment are not permitted, including care coordination and case management purposes.
  • Abbreviated notice of Part 2 prohibition on re-disclosure now permitted to assist users of electronic health record systems (EHRs): When making a disclosure under Part 2, the disclosing party must provide the recipient with notice of the prohibition on re-disclosure. Part 2 prescribes specific language for the notice of the prohibition on re-disclosure that must accompany each disclosure of Part 2 Records. Because many EHRs have a standard maximum character limit of 80 characters in the free text space that may be used to transmit this notice, the new rule provides disclosing parties with the option to use the following abbreviated notice of the prohibition on re-disclosure: “42 CFR part 2 prohibits unauthorized disclosure of these records.”
  • Disclosures of Part 2 records to subcontractors for audit and evaluation purposes: Subject to certain limitations, the new rule expands the scope of disclosure of Part 2 Records for purposes of audits and evaluations performed on behalf of federal, state, and local governments providing financial assistance to, or regulating the activities of both P art 2 programs as well as Lawful Holders. In addition, if disclosures are made for a Medicare, Medicaid, or CHIP audit /evaluation, including a civil investigation or administrative remedy, further disclosures may be made to contractors, subcontractors, or legal representatives to carry out the audit or evaluation.

SAMHSA announced that it will hold a public meeting on January 31, 2018 to solicit information and feedback from the public concerning the effect of Part 2 on patient care, health outcomes, and patient privacy, as required by Section 110002 of the 21st Century Cures Act.

Entities that are subject to Part 2 must assess the impact of the new regulation on operations and update policies and procedures to align with the new requirements. If you have questions about the changes to Part 2 or general questions regarding Part 2 compliance, please contact Elana Zana or Anthony Halbeisen.

Changes to Washington’s Pregnancy and Leave Laws

Accommodation of Pregnant Employees Effective July 23, 2017, employers in Washington State with 15 or more employees must provide specific reasonable accommodations for pregnant employees.  Undue hardship is not an excuse for some of the … [Continue reading]

Healthcare Mobile Device Encryption: Is It Required?

Encryption of mobile device technology has become essential in the eyes of the OCR.  Although HIPAA treats encryption as an “addressable” safeguard –as opposed to a “required” safeguard— under the Security Rule, the following OCR settlements … [Continue reading]

Failure to Provide Communication Aid Costs Hospital $20K

John Dempsey Hospital agreed to pay $20,000 as compensation to a patient after failing to provide auxiliary communication aids during an emergency department visit. The patient, who is deaf and uses American Sign Language for communication, had to … [Continue reading]

Texas Injunction on Modifications to “Exempt” Status May Affect WA Healthcare Employers

The Department of Labor’s (the “DOL”) new rule related to the salary-level test for exempt employees was challenged yesterday in a broad ruling from the Eastern District of Texas.  Yesterday, a federal judge in the Eastern District of Texas issued a … [Continue reading]

MACRA Released

On Friday, CMS released the MACRA final rules, its innovative payment system for Medicare replacing the sustainable growth rate formula and the EHR Incentive Program for Medicare providers. MACRA creates the framework for providers to participate … [Continue reading]

HIPAA Audit Program Phase II – Have You Been Selected?

Phase II of the HIPAA Audit Program has begun, with many covered entities and business associates receiving a "Audit Entity Contact Verification" message from the Department of Health and Human Services (HHS) and the Office of Civil Rights (OCR). The … [Continue reading]

Can non-MSSP ACOs qualify for Tax-Exempt Status?

The Internal Revenue Service (IRS) recently affirmed its decision to deny 501(c)(3) tax-exempt status to an accountable care organization (ACO) that did not participate in the Medicare Shared Savings Program (MSSP). The IRS initially denied the ACO’s … [Continue reading]

A Question of Privilege: Protecting Data in a Clinically Integrated Network

In this emerging era of healthcare reimbursement based on value, many providers are considering different ways to provide services to patients.  The old fee-for-service model, which often awarded providers based on volume, is being replaced with a … [Continue reading]

Home Is Where The Patient Is – The New Washington State Telemedicine Bill

It is official. The Washington State Legislature appears to have bought into the promise of telemedicine. For the second year in a row, the Legislature has passed a bill (Senate Bill 6519) that helps reduce the barriers to patient access to remote … [Continue reading]