ANALYSIS | 42 CFR Part 2 Rules Changes a Welcome Sign for Many Providers

On March 27, the Coronavirus Aid, Relief and Economic Security Act (CARES Act) was enacted to address the COVID-19 pandemic. The CARES Act also brought significant changes to 42 CFR Part 2 to partially align with the Health Insurance Portability and Accountability Act (HIPAA). Such changes will be effectuated by Department of Health and Human Services (HHS) regulations in the near future to apply to uses and disclosures subject to Part 2 on or after March 27, 2021. 

However, before the COVID-19 pandemic and the CARES Act changes to Part 2, the Substance Abuse and Mental Health Services Administration (SAMHSA) proposed, in August 2019, significant changes to Part 2, in part to assist providers to more easily share substance use disorder (SUD) information and promote better whole-person care. Last week, SAMHSA finalized its proposed rules, substantially as proposed, but as SAMHSA noted, with one caveat, which is revising Part 2 even further to prepare for the changes ahead based on the CARES Act. The final rules are a welcome sign for many providers that are seeking new ways to ensure optimal care for patients with a SUD during COVID-19, while still complying with health care privacy laws.

Some of the key finalized rules are discussed below.

Part 2 applies to disclosed Part 2 records, not specific SUD information to promote providing SUD information with privacy requirement flexibility. With SAMHSA’s updated Part 2 regulations in 2017, SAMHSA wanted to ensure that information created by a Part 2 Program (Part 2 Record) would remain protected by Part 2 even when a non-Part 2 provider obtains such Part 2 Record and subsequently uses and/or re-discloses it for healthcare operations and payment purposes. Such updated regulations led to much confusion for non-Part 2 providers on what information they used from a Part 2 Record actually was protected by Part 2. SAMHSA, in its proposed and finalized regulations, clarified that a non-Part 2 provider would only be subject to Part 2 if the non-Part 2 provider could not properly segment or segregate any Part 2 Records it receives from a Part 2 program from its own treatment record. SAMHSA’s goal in this clarification is to ensure that non-Part 2 providers (such as a primary care physician) may receive SUD information from a Part 2 program and use such information as necessary in their own record of clinical encounters without automatically being triggered to comply with Part 2. Furthermore, the SUD information in the non-Part 2 provider’s own record could subsequently be re-disclosed to others without having to comply with Part 2.

Allowing patients to consent to more disclosures to assist on focusing on social determinants of health. SAMHSA also finalized in the Part 2 rules to allow patients to consent to disclosure to entities without a treating provider relationship without having to name a specific individual that would receive the Part 2 Record. Such change is welcomed by many since several patients before were meeting significant challenges in providing their SUD information to government agencies and social support programs for benefits and other support resources (such as the Social Security Administration for social security benefits). Now patients can more easily apply and provide necessary SUD information to government agencies and social supports programs, which are critical players in providing optimal SUD treatment.

Part 2 records can now be disclosed for case management and care coordination purposes. The most drastic change to Part 2, and a significant change from SAMHSA’s previous position, is regarding the sharing of Part 2 Records for care coordination and case management purposes. Prior to the proposed 2019 rules, SAMHSA clarified the scope and requirements for permitted disclosures by lawful holders of Part 2 records to their contractors and subcontractors for certain payment and health care operations purposes. SAMHSA has, however, provided in the 2018 final Part 2 rules and again in the 2019 proposed rules that disclosures to contractors and subcontractors could not be for activities related to a patient’s diagnosis, treatment or referral for treatment. Therefore, SAMHSA noted again in the 2019 proposed rules that, unlike HIPAA, disclosures for care coordination and case management purposes were still being proposed as prohibited under Part 2. 

In the finalized rules, SAMHSA now allows care coordination and case management as activities for which a lawful holder may make a further disclosure to its contractors and subcontractors. SAMHSA noted that while it did not specifically propose this in the 2019 proposed rules, it believed such additional activities were acceptable to be added without an additional notice and comment period because of the forthcoming CARES Act Part 2 changes. Furthermore, SAMHSA believed it had already received significant comments about the necessity of care coordination and case management being included as purposes for permissible re-disclosure under Part 2.

What’s next?

SAMHSA provides throughout the finalized rules that they serve as interim and transitional standards until the anticipated HHS regulations for the CARES Act come into effect. Until then, the finalized rules demonstrate that SAMHSA is seeking as many ways as possible to alleviate any challenges to improving coordinated and integrated care, while still seeking to maintain privacy protections for patients.  

Jena M. Grady is an attorney in Nixon Peabody’s Health Care group who focuses her practice on behavioral health.