Printer Friendly

New rules for substance abuse records.

Byline: Barry Rosen

Early last year, a final rule went into effect that updates the Confidentiality of Substance Use Disorder Patient Records regulations, adopted by the Substance Abuse and Mental Health Services Administration (SAMHSA).


SAMHSA regulations protect the confidentiality of records that contain the identity, diagnosis, prognosis or treatment of patients when the records are maintained in connection with the performance of any program that receives federal assistance, including Medicare or Medicaid payments, for substance abuse education, prevention, training, treatment, rehabilitation or research.

Importantly, the regulations not only apply to individuals and entities who receive such federal assistance, but also to individuals and entities that have received patient records in compliance with the regulations (Lawful Holders). Basically, Lawful Holders are people and entities to whom the information has been lawfully disclosed.


As originally adopted, the SAMHSA regulations required any disclosure of a patient record made pursuant to patient consent to include a lengthy written notice about the prohibition on re-disclosure. The final rule amends this requirement to better suit electronic health record systems and permits the notice to be written in a single abbreviated sentence: "42 CFR part 2 prohibits unauthorized disclosure of these records."

The original regulations also prohibited a Lawful Holder from re-disclosing a patient record to a third party without obtaining additional specific patient consent. The final rule loosens this prohibition by permitting re-disclosures by Lawful Holders in certain circumstances.

Under the final rule, a Lawful Holder that receives a patient record for the purposes of payment or health care operations pursuant to a patient's consent may re-disclose that patient record to contractors, sub-contractors or legal representatives of the Lawful Holder as is necessary to carry out those payment or health care operations.

However, while the scope of activities that constitute payment operations is broad, the scope of activities that constitute health care operations is much narrower. The final rule states that health care operations under the SAMHSA regulations do not include activities such as care coordination, case management, patient diagnosis, patient treatment or referral for patient treatment. For example, a provider to whom records are sent for treatment with the patient's consent must again get the patient's consent to re-disclose the records to another provider to whom the patient is subsequently referred.

The logic underlying this requirement underscores the difference between the SAMHSA regulations and the Health Insurance Portability and Accounting Act (HIPAA) Privacy Rule. Just as the disclosure of substance abuse records to a referred provider requires patient consent under SAMHSA but not under HIPAA, a re-disclosure of the records to yet another provider also requires patient consent under SAMHSA but not under HIPAA.

Written contracts

Lawful Holders of patient records are also required to have written contracts or comparable legal instruments with any contractor or legal representative to whom the Lawful Holder re-discloses patient records. Any such contract or legal instrument must require the contractor or legal representative to comply the SAMHSA regulations.

Specifically, the final rule requires such contracts or legal instruments to include: (1) the re-disclosure notice as discussed above; (2) a requirement that recipients implement appropriate safeguards to prevent unauthorized use and disclosure of patient records; and (3) a requirement that recipients report any unauthorized use, disclosure or breach of patient identifying information to the Lawful Holder.

Future developments

The privacy of substance abuse records were the subject of continued legislative and regulatory attention throughout 2018. The SUPPORT for Patients and Communities Act, the federal opioids legislation signed into law on Oct. 24, 2018, originally contained provisions that would have permitted disclosure and re-disclosure of substance abuse records in the same manner as health information under the HIPAA Privacy Rule.

Further, despite the recent regulatory changes to the SAMHSA regulations, Health and Human Services (HHS) Secretary Alex Azar indicated, during a July 26, 2018, speech to the Heritage Foundation, that HHS would be making additional changes to the SAMHSA regulations and HIPAA regulations. In fact, on Dec. 14, 2018, HHS issued a request for information (RFI) seeking input on modifications to the HIPAA regulations related to substance abuse disorders, and a similar RFI seeking public input on further reforms to SAMHSA regulations may be forthcoming.

Barry F. Rosen, the chairman and CEO of Gordon Feinblatt LLC, heads the law firm's Health Care Practice Group. He can be reached at 410-576-4224 or Andrew Wichmann is an associate in the firm's Intellectual Property and Health Care practice groups and can be reached at 410-576-4072 or

Copyright {c} 2019 BridgeTower Media. All Rights Reserved.
COPYRIGHT 2019 BridgeTower Media Holding Company, LLC
No portion of this article can be reproduced without the express written permission from the copyright holder.
Copyright 2019 Gale, Cengage Learning. All rights reserved.

Article Details
Printer friendly Cite/link Email Feedback
Publication:Daily Record (Baltimore, MD)
Date:Mar 7, 2019
Previous Article:ACLU, NAACP, parents ask court to reopen Baltimore school funding case.
Next Article:Does parents' immunity from children's suits apply to wrongful death?

Terms of use | Privacy policy | Copyright © 2020 Farlex, Inc. | Feedback | For webmasters