National Council for Mental Wellbeing

Skip to content National Council for Mental Wellbeing
Find a Provider
National Council for Mental Wellbeing logo
Your source for the latest updates from Capitol Hill. We translate policy into practice so you can learn how policy trends will affect your work and how best to prepare.

Shelley Starkey

SAMHSA Proposes Changes to Part 2 SUD Privacy Rules

August 29, 2019 | Addictions | Privacy & HIPAA | Comments
Share on LinkedIn

The Substance Abuse and Mental Health Services Administration (SAMHSA) has released a proposed rule that would change the way substance use disorder (SUD) treatment records are shared under 42 CFR Part 2. Although the Trump administration does not have the authority to fully align 42 CFR Part 2 with the Health Information Portability and Accountability Act (HIPAA), the administration stated that its proposal aims to “facilitate better coordination of care for substance use disorders, which will also enhance care for opioid use disorder,” according to an official fact sheet on the proposal. Meanwhile, critics expressed concern that the changes to the rule would undermine patient confidentiality and willingness to seek treatment. SAMHSA is accepting public comments on these proposed changes until October 24, 2019.

42 CFR Part 2 currently prohibits the sharing of SUD treatment records between health care providers without a patient’s explicit consent and includes protections for patient records in criminal and civil legal proceedings. According to SAMHSA, the proposed rule will not change the restrictions on using SUD patient records in criminal prosecutions and will continue to restrict the disclosure of these records without patient consent. The changes included in the proposal are:

  • Consent Requirements: A patient may consent to disclosure of their SUD treatment records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure.
  • Applicability and Re-Disclosure: Treatment records created by non-SUD treatment providers based on their own patient encounters will not be covered by part 2, unless any SUD records previously received from a part 2 program are incorporated into such records. Part 2 patient records can be separated out to ensure that new records created by non-part 2 providers will not become subject to part 2.
  • Medical Emergencies: Declared emergencies resulting from natural disasters that disrupt treatment facilities and services will meet the definition for a “bona fide medical emergency,” for the purpose of disclosing SUD records without patient consent under part 2.
  • Confidential Communications: The standard for court ordered disclosures of SUD records for the purpose of investigating “an extremely serious crime” will be revised, by dropping the phrase “allegedly committed by the patient.” This is meant to serve as a correction to a technical error from 2017 rule-making in which this phrase was inadvertently added without notice or public comment.
  • Disposition of Records: When a patient sends an incidental message to the personal device of an employee of a part 2 program, the employee will be able to fulfill the part 2 requirement for “sanitizing” the device by deleting that message.
  • Disclosures Permitted with Written Consent: Disclosures for the purpose of “payment and health care operations” are permitted with written consent, in connection with an illustrative list of 17 non-exhaustive example activities listed on page 31 of the proposal, which include instances such as billing, claims management, collections activities, credentialing activities and more.
  • Disclosures to Central Registries and Prescription Drug Monitoring Programs (PDMPs): Non-opioid treatment program (OTP) providers will become eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program. OTPs will be permitted to enroll in a state prescription drug monitoring program and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.
  • Research: Disclosures for research under part 2 will be permitted by a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to regulations surrounding research on human subjects.
  • Audit and Evaluation: Part 2 will be revised to clarify that some specific situations fall within the scope of permitted disclosures for audits and/or program evaluation.
  • Undercover Agents and Informants: Court-ordered placement of an undercover agent or informant within a part 2 program will be extended to a period of 12 months, and courts will be authorized to further extend the period of placement through a new court order.

Supporters of the rule change believe that making SUD treatment records easier to share will enhance the coordination of patients’ care across settings. “This is a good step forward in breaking down barriers for people with substance use disorders to receive effective integrated care,” said Dr. Saul Levin, CEO and medical director for the American Psychiatric Association. “We will continue to work with the Administration and Congress to address the remaining barriers.”

On the other hand, critics argue that allowing more easily shareable records will be detrimental to individuals who might avoid seeking care for fear of facing stigma or discrimination or potential legal consequences. “With over 90% of people with substance use disorders not currently accessing treatment, weakening the current protections for patient privacy contained in Part 2 will not fix what is broken,” said Dr. H. Westley Clark, who served as director of the SAMHSA Center for Substance Abuse Treatment from 1998-2014. “Instead, it will drive even more people away from substance use disorder treatment and penalize the over 20 million people in recovery from substance use disorders.”

Secretary of Health and Human Services, Alex Azar called on Congress to continue their work to fully align 42 CFR Part 2 with HIPAA, via legislation such as the Overdose Prevention and Patient Safety Act (H.R. 2062) and its companion bill in the Senate, the Protecting Jessica Grubb’s Legacy Act (S. 1012).