Substance Abuse Medical Record Privacy Rules Updated For The First Time in Nearly 30 Years

Originally scheduled to be effective February 17, 2017, SAMSHA announced on February 16, 2017, that the revised rules will now be effective March 21, 2017, pursuant to the terms of the regulatory freeze issued by the Trump administration on January 20, 2017.  Substance use disorder treatment providers and other lawful holders of protected information should take the opportunity offered by the regulatory freeze to ensure their policies and procedures on patient confidentiality, consent documents, and re-disclosure statements are in compliance with the new requirements before they become effective.

Background

The Part 2 Regulations apply to federally assisted drug or alcohol abuse programs (as defined by the regulations) (each a Part 2 Program).  In addition, under the revised rules, the Part 2 Regulations now also cover disclosures from “other lawful holders of patient identifying information,” which are entities that have received such information via a Part 2-compliant consent or through an exception to the Part 2 consent requirements. The regulations are meant to ensure confidentiality for patients receiving treatment for a substance use disorder, out of concern that inappropriate disclosures of these patient records could result in a host of negative consequences, such as loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, and incarceration. As noted by SAMSHA, the revised regulations are designed to address the significant changes that have occurred in the U.S. health care system since the rules were last updated in 1987, such as new models of integrated care requiring information sharing for coordination of patient care, the use of electronic medical record systems, and a new focus on performance measurement within health systems.

SAMSHA published the proposed revisions to the Part 2 Regulations on February 9, 2016.  In our blog post analyzing the proposed revisions, we summarize the major provisions and the requirements affecting covered programs and others affected by the changes.

Changes from the Proposed Rule

The final rule largely adopts the regulations as proposed in the February 2016 proposed rule. Notably, SAMSHA chose not to finalize its proposal to add “general medical practices” to the definition of Part 2 Programs under certain conditions.  SAMHSA also decided not to finalize its proposal to eliminate the general designation option for the “From Whom” section of the consent requirements. Thus, the final “From Whom” provision of the consent requirements can still be met by including a general designation of the Part 2 programs, entities, or individuals permitted to make the disclosure on the written consent form.

Conclusion

As mentioned above, the regulatory freeze provides those affected by SAMSHA’s final rule the unintended benefit of extra time to ensure compliance with the new requirements. Affected entities should revise consent forms as necessary, develop a process to track disclosures made pursuant to patient request, and implement security measures that comply with SAMHSA’s requirements.

Arent Fox attorneys regularly assist clients with implementing and strengthening their policies and procedures to protect sensitive health information, including substance abuse disorder treatment information.