Rule Makes Substance Abuse Records Easier to Disclose

Stay ahead of developments in federal and state health care law, regulation and transactions with timely, expert news and analysis.

By James Swann

Health-care providers will have a freer hand in disclosing patient substance abuse records, courtesy of a government rule intended to align privacy protections with new health-care delivery models.

The Substance Abuse and Mental Health Services Administration said its final rule (RIN:0930-ZA07) released Jan. 2 is an attempt to balance patient privacy concerns against the need to ensure that substance abuse patients can participate in integrated health-care models that require broader disclosures.

The new rule continues SAMHSA’s efforts to provide greater flexibility in permitting the disclosure of Part 2 alcohol and drug abuse records within the health-care system while still protecting patient privacy, W. Reece Hirsch, a health-care attorney with Morgan, Lewis & Bockius LLP in San Francisco, told Bloomberg Law Jan. 2. Part 2 refers to the section of the U.S. Code of Federal Regulations (42 CFR Part 2) covering the confidentiality of patients’ alcohol and drug abuse records.

The final rule, which was driven by the growth of electronic health records and increased health-care integration, spells out when substance abuse records can be disclosed for payment, operations, and audit purposes. It also authorizes providers to use a shorter notice prohibiting the re-disclosure of patient records.

SAMHSA said the shorter notice would be easier for providers who use electronic health records systems.

The final rule follows a Jan. 18, 2017, final rule (RIN:0930–AA21) from SAMHSA that eased substance abuse disclosures by allowing patients to give general consent to the sharing of their records instead of requiring individual consent every time a record was shared.

Good and Bad

The final rule has both good and bad news for health-care providers, Alisa Chestler, a health-care attorney with Baker, Donelson, Bearman, Caldwell & Berkowitz in Nashville, Tenn., told Bloomberg Law Jan. 2.

While SAMHSA has tried to align the disclosures with HIPAA rules and definitions, it declined to follow HIPAA in certain key areas, Chestler said.

For example, when discussing disclosures for health-care operations, care coordination and case management activities are specifically omitted, Chestler said.

“Providers should immediately begin to review the consent they have patients execute at the time of admission and determine if modifications are necessary,” Chestler said. It’s likely that most providers will need to modify their patient intake paperwork, Chestler said.

Changes Overdue

Until last year’s final rule, the Part 2 regulations hadn’t been updated since years before the creation of the Health Insurance Portability and Accountability Act, so the recent changes have been long overdue, Eric Fader, a health-care attorney with Day Pitney LLP in New York, told Bloomberg Law Jan. 2.

SAMHSA’s request for public comments in conjunction with last year’s final rule gave health-care stakeholders a chance to weigh in, and the new rule fills in the missing gaps, Fader said.

“Industry awareness and compliance with HIPAA and the HITECH Act, and the available regulatory guidance regarding HIPAA, were far ahead of those for Part 2, so the new rule will certainly improve compliance with Part 2,” Fader said.

The Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009, promotes the adoption and meaningful use of health information technology.

Although Part 2 provides tougher protections for substance abuse records than HIPAA, the new rule references the more familiar HIPAA requirements, which should make providers’ lives easier, Fader said.

“Just as information flow and interoperability of electronic health records systems are critical in this era of increasing care coordination and value-based care, the governing regulations should also be interoperable to the extent possible so that sloppy inconsistencies between them don’t impede innovation,” Fader said.

Abbreviated Notice

One of the most notable elements of the new final rule is SAMHSA’s approval of an abbreviated form of the language to be included in a patient consent disclosure form that notifies the recipient that they can’t make any further disclosures without additional patient consent, Hirsch said.

SAMHSA recognized that requiring a more detailed notice could promote a better understanding of the Part 2 privacy requirements, Hirsch said, but still approved the abbreviated language.

“SAMHSA’s approval of the abbreviated consent form language should give health-care providers a bit of welcome flexibility in handling substance abuse information,” Hirsch, a Bloomberg Law advisory board member, said.

There’s been an ongoing tension between the rigorous disclosure requirements of Part 2 and the broad range of permissible disclosures of protected health information under HIPAA, Hirsch said.

“The 2017 regulations and these supplementing regulations are generally intended to reconcile those two laws in a way that still preserves special protections for Part 2 information,” Hirsch said.

To contact the reporter on this story: James Swann in Washington at

To contact the editor responsible for this story: Kendra Casey Plank at

Copyright © 2018 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Health Care on Bloomberg Law