SAMHSA has finalized provisions relating to the disclosure of patient-identifying substance use information for payment and healthcare-related purposes and the disclosure of patient-identifying substance use information for the purposes of carrying out an audit or evaluation.
On January 3, 2018, the Substance Abuse and Mental Health Services Administration (SAMHSA) finalized revisions to the Confidentiality of Substance Use Disorder Patient Records regulations, found in 42 CFR Part 2. The new final rule implements the changes proposed a year ago by SAMHSA in its supplemental notice of proposed rulemaking (SNPRM), which was issued alongside the first major changes to the federal regulations governing Part 2 covered data since 1987. After receiving public comment on the SNPRM, SAMHSA has finalized provisions relating to the disclosure of patient-identifying substance use information for payment and healthcare-related purposes and the disclosure of patient-identifying substance use information for the purposes of carrying out a Medicaid, Medicare or Children’s Health Insurance Program (CHIP) audit or evaluation. The new final rule also permits lawful holders to issue an abbreviated notice of the prohibition on redisclosure to accommodate electronic health record systems with standard character limitations on free text fields. The rule was carefully drafted by SAMHSA with industry input to respond to changes in the substance abuse services industry. Unfortunately, it does not supersede state laws, which may be much stricter, such as Pennsylvania’s.
The new final rule permits greater flexibility on additional disclosures of patient records by a lawful holder of patient information for purposes of payment and healthcare operations. The language in the 2018 rule permits lawful holders of patient-identifying substance use information to further disclose these patient records to its contractors, subcontractors or legal representatives in order carry out the payment or healthcare operations activities authorized by the patient’s written consent. Under the final rule, additional disclosures are permissible for the purposes of payment and healthcare operations, which include activities such as billing, claims management, collections activities, clinical professional support services, patient safety activities, third-party liability coverage, accreditation and certification, and general administrative activities.
Although it does allow for greater flexibility, the 2018 rule maintains the confidentiality of patient-identifying substance use information by requiring contractors, subcontractors or legal representatives to agree to be fully bound by the provisions of Part 2 upon receipt of the patient records. Additionally, the final rule limits disclosure to activities within the scope of “payment and healthcare operations.” This does not include disclosures for purposes of diagnosis, treatment or referral activities. These changes go into effect on February 2, 2018.
For More Information
If you have any questions about this Alert, please contact Lisa W. Clark, Erin M. Duffy, any of the attorneys in our Health Law Practice Group or the attorney in the firm with whom you are regularly in contact.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.