Mid-Atlantic Health Law TOPICS

On February 2, 2018, a final rule went into effect that updates the Confidentiality of Substance Use Disorder Patient Records regulations, adopted by the Substance Abuse and Mental Health Services Administration (SAMHSA).

A.  Background

SAMHSA regulations protect the confidentiality of records that contain the identity, diagnosis, prognosis or treatment of patients when the records are maintained in connection with the performance of any program that receives federal assistance, including Medicare or Medicaid payments, for substance abuse education, prevention, training, treatment, rehabilitation or research.

Importantly, the regulations not only apply to individuals and entities who receive such federal assistance, but also to individuals and entities that have received patient records in compliance with the regulations (lawful holders). Basically, lawful holders are people and entities to whom the information has been lawfully disclosed.

B.  Changes to the Regulations

As originally adopted, the SAMHSA regulations required any disclosure of a patient record made pursuant to patient consent to include a very lengthy written notice about the prohibition on re-disclosure. The final rule amends this requirement to allow for the notice to be written in a single abbreviated sentence: “42 CFR part 2 prohibits unauthorized disclosure of these records.”

The original regulations also prohibited a lawful holder from re-disclosing a patient record to a third party without obtaining additional specific patient consent. The final rule loosens this prohibition by permitting re-disclosures by lawful holders in certain  circumstances.

Under the final rule, a lawful holder that receives a patient record for the purposes of payment or health care operations pursuant to a patient’s consent may re-disclose that patient record to contractors, sub-contractors or legal representatives of the lawful holder as is necessary to carry out those payment or health care operations.

However, while the scope of activities that constitute payment operations is broad, the scope of activities that constitute health care operations is much narrower. For example, the final rule states that health care operations under the SAMHSA regulations do not include activities such as care coordination, case management, patient diagnosis, patient treatment or referral for patient treatment. For example, a provider to whom records are sent for treatment with the patient’s consent must again get the patient’s consent to re-disclose the records to another provider to whom the patient is subsequently referred.

The logic underlying this requirement underscores the difference between SAMHSA and the Health Insurance Portability and Accounting Act (HIPAA) Privacy Rule. Just as the disclosure of substance abuse records to a referring provider requires patient consent under SAMHSA, but not under HIPAA, a re-disclosure of the records to yet another provider also requires patient consent under SAMHSA, but not under HIPAA.

Lawful holders of patient records are also required to have written contracts or comparable legal instruments with any contractor or legal representative to whom the lawful holder re-discloses patient records. Any such contract or legal instrument must require the contractor or legal representative to comply with the SAMHSA regulations.

Specifically, the final rule requires such contracts or legal instruments to include: (1) the re-disclosure notice as discussed above; (2) a requirement that recipients implement appropriate safeguards to prevent unauthorized use and disclosure of patient records; and (3) a requirement that recipients report any unauthorized use, disclosure or breach of patient identifying information to the lawful holder.

Ned T. Himmelrich
410-576-41741 • nhimmelrich@gfrlaw.com

A version of this article was published by The Daily Record on March 7, 2019.