On July 15, 2020, the Substance Abuse and Mental Health Services Administration (SAMHSA) made substantial changes to the permitted uses and disclosures of substance use disorder (SUD) records for programs covered by 42 C.F.R. Part 2. The stated intent of the final rule is to facilitate the provision of well-coordinated SUD care. The rules do indeed appear to remove regulatory barriers that have made it difficult for SUD providers to engage in the type of care coordination activities that are increasingly common outside the substance abuse context.

Perhaps the most significant change to the rules is the expansion and clarification of the permitted uses and disclosures for the purposes of “health care operations.”  A Part 2 program has long been able to obtain patient consent for the use and disclosure of substance abuse information for “payment and/or health care operations.” Previously, however, the relevant rules explicitly stated that “health care operations” cannot include disclosures “to carry out other purposes such as substance use disorder patient diagnosis, treatment, or referral for treatment.” 83 Fed. Reg. 239-01, 243 (Jan. 3, 2018). SAMHSA specifically advised that this language meant that the term “health care operations” is “not intended to cover care coordination or case management.” Id.

Through these recent rule changes, SAMHSA effectively has reversed this guidance and now defines the term “health care operations” to include any “payment/health care operation activities not expressly prohibited,” including “care coordination and/or case management services.” This more closely aligns with the definition of “health care operations” found in HIPAA and will allow the disclosure of SUD records to entities that perform care coordination services. It also will allow such entities to disclose such records to its contractors or legal representatives for health care operations. We note, however, that any disclosure for health care operations still will require specific patient authorization. 42 C.F.R. § 2.31.

SAMHSA also amended the rules regarding valid patient consent to facilitate the disclosure of Part 2 information to organizations without a treating provider relationship with the patient. Specifically, when the potential recipient lacks a treating provider relationship with the patient, Part 2 previously required that the consent form specify the specific individual(s) who would receive the information. This made it difficult for a Part 2 program to facilitate the ongoing exchange of substance use disorder records with third-party care coordination organizations, which cannot necessarily specify an individual recipient. The revised rules allow a patient to consent to the disclosure of Part 2 information to an organization that provides care coordination services. This change allows for more flexibility in the use and disclosure of patient information for care coordination and case management.

Note that these changes only presage greater liberalization of Part 2 rules pursuant to the Coronavirus Aid, Relief and Economic Security Act (CARES Act). The CARES Act amends several sections of the Part 2 authorizing statute (42 U.S.C. § 290dd-2) to, among other things facilitate the use and disclosure of SUD records for treatment, payment and health care operations as permitted by the HIPAA regulations upon written consent. These provisions cannot take effect before March 27, 2021. We anticipate that SAMHSA will implement rules that further expand the scope of permissible substance use data sharing to be effective as of such date.

We routinely advise Part 2 programs about the use and disclosure of SUD records, and we encourage you to reach out to us.