On January 3, 2018, the federal Substance Abuse and Mental Health Services Administration (SAMHSA) adopted a second round of changes to the regulations mandating strict confidentiality of substance use disorder (SUD) treatment information[1] (known in the industry as simply the “Part 2” regulations). The first round occurred a year ago when SAMHSA loosened patient consent requirements in order to facilitate inclusion of SUD information in electronic health information exchanges and accountable care organizations. The second round is intended to encourage SUD programs to use electronic health records, and to facilitate more efficient administration of the health care delivery system when SUD information is involved.

In this second round of changes to Part 2, SAMHSA does three things:

  • It allows SUD programs to use a shortened re-disclosure notice when the program discloses SUD information with patient consent. The shortened notice should fit into data field limitations common in many electronic health records. The SAMHSA long form is still usable, but programs may opt for the short form.
  • It allows any “lawful holder” of SUD information to re-disclose the information to its contractors for the purposes of payment and health care operations without obtaining further patient consent. A “lawful holder” is any entity that possesses SUD information pursuant to a patient consent. Although this sounds a lot like a standard HIPAA business associate relationship, SAMHSA warns that it is not identical. The purposes for which SUD information can be shared are not the same as HIPAA’s “treatment, payment and health care operations.” SAMHSA specifically prohibits using the new “lawful holder” exception to make disclosures for treatment purposes or for case management. All disclosures and re-disclosures for treatment or case management require specific patient consent. Further, regulatory commentary indicates SAMHSA does not interpret “health care operations” as broadly as HIPAA does, even though it declined to include a specific definition in the amended Part 2. Before a lawful holder can make re-disclosures pursuant to this new exception, the lawful holder and contractor must have a formal contract that obligates the recipient to be bound by Part 2 in its handling of the SUD information that it receives. Lawful holders and contractors must have their contracts in place by two years from the effective date of the amendments to Part 2, which will be February 2, 2020.
  • It makes it easier for federal, state and local governmental payors to conduct audits of Part 2 programs and their lawful holders and contractors when access to SUD information is needed.

SAMHSA has struggled in the last few years with two countervailing pressures. On the one hand, it has attempted to modernize Part 2 to permit more data exchange so that SUD patients can take advantage of value-based and integrated programs designed to deliver improved care. On the other hand, SAMHSA still desires to protect SUD patients from the stigma and discrimination that can result from disclosure of this sensitive information. Of course, SAMHSA is constrained by the federal statute that governs Part 2[2], and therefore cannot authorize disclosures that are not permitted by that law.

It appears, however, that SAMHSA is slowly moving toward harmonizing Part 2 with HIPAA, or at least some key concepts of HIPAA. It will hold a listening session on January 31, 2018, to solicit comments from the SUD treatment industry and SUD patients to help inform its future rulemaking.