Health Law News

Print PDF

SAMHSA Releases Changes to “Part 2” Confidentiality Regulations

Posted on January 25, 2017 in Health Law News

Published by: Hall Render


On January 18, 2017, the United States Department of Health and Human Services (“HHS”) Substance Abuse and Mental Health Services Administration (“SAMHSA”) issued final regulations (the “Final Rule“) intended to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations at Title 42 of the Code of Federal Regulations, Part 2 (“Part 2”). As explained below, Part 2’s stringent protections for patient identifying information remain in full effect, and even after the Final Rule takes effect, no Part 2 program will be required to disclose patient identifying information. Changes in the Final Rule should, however, significantly simplify the disclosure consent forms, known as the “release of information” or “ROI,” required in Part 2 programs.

Notably, though the Final Rule was slated to take effect on February 17, 2017, a January 20, 2017 memorandum from the president (via the White House Office of the Press Secretary) delays any possible effective date for 60 days from the date of the memorandum. While it is not yet clear how this directive will impact the effective date, it appears that the earliest the Final Rule can become effective is March 21, 2017.

Need for Regulatory Action

The Final Rule adopts several of the modifications included in SAMHSA’s Part 2 proposed rulemaking (“NPRM“) of February 9, 2016. As noted in both the NPRM and the Final Rule, this revision to Part 2 is required to address significant changes that have occurred in the health care industry since SAMHSA’s last update in 1987, including new models of care and the widespread adoption of electronic information technology. Multidisciplinary care models rely on information sharing to coordinate patient care, and the efficient sharing of patient information is integral to patient safety and quality of care. Finally, a new focus on performance measurement requires that providers track and report information to administrative bodies.

SAMHSA received 375 public comments in response to the NPRM. After consideration of comments in support of and opposition to the NPRM, SAMHSA issued the Final Rule. The Final Rule revises 14 provisions of Part 2. According to HHS Deputy Assistant Secretary Kana Enomoto, the Final Rule “will further enhance health services research, integrated treatment, quality assurance and health information exchange activities while at the same time safeguarding the essential privacy rights of people seeking treatment for substance use disorders.”

Changes to Part 2

Below is an overview of the Final Rule’s major changes to Part 2.

  • Definition (§ 2.11). The Final Rule revises most of the definitions applicable to Part 2, leaving only five definitions – “diagnosis,” “informant,” “minor,” “third-party payer” and “undercover agent” – unchanged. For example, the definition of a “qualified service organization” now includes individuals or entities that “[p]rovide[ ] population health management” to a Part 2 program.
  • Applicability (§ 2.12). Part 2 will continue to apply to a program that is federally assisted and holds itself out as providing substance use disorder diagnosis, treatment or referral for treatment. Part 2 will also continue to apply to such a program that is part of a general medical facility. The Final Rule deletes references to “general medical practices” and standardizes references using the term “general medical facilities.”  While “general medical facilities” remains undefined, prior guidance from SAMHSA, including its frequently asked questions, remains in effect, so that entities previously considered general medical facilities continue to so qualify.
  • Confidentiality Restrictions and Safeguards (§ 2.13). The Final Rule permits patients to include a general disclosure designation (described below) of treating providers on the consent form as the recipient of their information. It also requires Part 2 programs to provide to patients, upon request, a list of entities to whom their information has been disclosed (referred to as a List of Disclosures), including a specific list of the information included in those disclosures.
  • Security for Records (§ 2.16). SAMHSA clarifies that both Part 2 programs and other lawful holders of patient identifying information must have in place formal policies and procedures addressing physical and, as appropriate, electronic security for both paper and electronic records, including procedures for the destruction of records and sanitization of associated media.
  • Consent Requirements (§ 2.31). In certain circumstances, patients may consent to disclose their information using a general designation to individuals or entities (e.g., “all my treating providers”). However, programs are prohibited from using general designations on consent forms until they can provide patients with the Lists of Disclosures described above. SAMHSA clarified that if a patient uses a general designation listing “my treating providers” without specifying whether such providers are “past, current, or future,” it should be presumed that the patient intended to designate “current” treating providers. Notably, if the program is part of a general medical facility, this provision also permits the patient to designate the entire entity, provided that a list of information to be disclosed is included on the consent form.
  • Prohibition on Re-Disclosure (§ 2.32). SAMHSA clarifies that the prohibition on re-disclosure of a patient’s information only applies to information that identifies patient as having or having had a substance use disorder either directly or indirectly.
  • Research (§ 2.52). Any lawful holder of patient identifying information may disclose Part 2 patient identifying information to qualified personnel for purposes of conducting scientific research if the researcher meets certain regulatory requirements. De-identified information, as described in § 2.16, can still be shared for  research purposes. The Final Rule also permits data linkages to enable researchers holding Part 2 data to link to data sets from federal and non-federal data repositories, provided certain regulatory requirements are met.
  • Audit and Evaluation (§ 2.53). The Final Rule includes changes that permit an audit or evaluation in order to meet the requirements of accountable care organizations (“ACOs”) or similar CMS-regulated organizations.
  • Technology Changes. The term “written” now includes both paper and electronic documentation.

SAMHSA also issued a Supplemental Notice of Proposed Rulemaking (“SNPRM“) on December 13, 2016. Pursuant to the SNPRM, SAMHSA seeks further comments regarding restrictions on disclosures of Part 2 data to contractors, subcontractors and legal representatives. Comments must be received by 5:00 PM on February 17, 2017. Provisions of the SNPRM include:

  • Payment and health care operations-related disclosures of Part 2 data that can be made to contractors, subcontractors and legal representatives of a lawful holder of Part 2 data;
  • Use of contractors, subcontractors and legal representatives to conduct audit and evaluation activities of ACOs and other similar CMS-regulated entities; and
  • An abbreviated alternative statement for the notice that accompanies disclosure (e.g., “Data is subject to 42 CFR Part 2”).

Practical Takeaways

Changes permitting general designations on the disclosure consent form should significantly simplify programs’ compliance with Part 2’s strong patient protection mandate while facilitating the information flow required for optimal patient care and patient safety.  Most changes required by the Final Rule require compliance by the effective date; however, as noted in the introduction above, the effective date is currently uncertain. To promote compliance upon the eventual effective date, we recommend that programs do the following.

  • Update consent forms to reflect the Final Rule. Signed consent forms in place prior to the effective date will be valid until they expire. Consents obtained by Part 2 programs after the effective date must comply with the Final Rule.
  • Update policies and procedures, including staff training policies, consent procedures and procedures addressing physical and electronic security for records covered by Part 2.

If you have questions or would like additional information about the changes to Part 2, please contact:

Please visit the Hall Render Blog at or click here to sign up to receive Hall Render alerts on topics related to health care law.