Update for providers: Significant changes to SAMHSA 42 CFR Part 2 privacy regulations

Federal regulations governing the confidentiality of drug and alcohol treatment records impact the clinical and operational processes of a wide variety of providers across the country, including Netsmart clients. Based largely on legislation originally adopted in 1972, these regulations – commonly referred to as 42 CFR Part 2 – apply to providers receiving federal funds and were designed to prevent the disclosure of patients’ substance use treatment records to employers, landlords, law enforcement and other parties for fear of stigma, discrimination and legal ramifications.

Much has changed since the 1970s, including the advent of integrated, coordinated care delivery models like health information exchanges (HIEs) and health homes, widespread use of electronic health records and connectivity tools, e-prescribing, medication-assisted treatment, and newer federal and state privacy and security safeguards.

The majority of patients with a serious mental illness or a substance use treatment disorder (SUD) also have co-morbid chronic diseases or conditions such as diabetes, COPD, heart disease or emphysema. Access to a person’s complete health record, including SUD information, allows their treating providers to make fully-informed diagnosis and treatment decisions. It also helps prevent risk of serious or even fatal drug interactions and unintended prescribing errors due to lack of complete patient information.

Why is this notable right now? Providers should understand how recent regulatory updates and more changes to come in 2021 based on legislation included in the CARES Act will impact how they manage SUD treatment information to positively impact the lives of those they serve.

New SAMHSA 42 CFR Part 2 Final Rule

In rare federal rulemaking attention to one topic, the Substance Abuse and Mental Health Services Administration (SAMHSA) has issued multiple updated 42 CFR Part 2 Final Rules in the past three years. The most recent Final Rule was announced July 15, 2020 and took effect August 14. It retains the foundation for confidentiality protection of SUD patient records created by federally-assisted SUD treatment programs (“Part 2” programs). The rule also:

• Adds care coordination and case management services to the list of payment and healthcare operations activities for which non-Part 2 providers may redisclose Part 2 records without patient consent beyond the initial consent provided to the Part 2 program provider;
• Makes changes to facilitate the disclosure of records from Part 2 programs to non-Part 2 providers for treatment purposes, while allowing non-Part 2 providers to engage in their own clinical encounters and record-keeping knowing that those activities will not be subject to Part 2;
• Offers revised guidance regarding Part 2 consent requirements in order to more explicitly allow patients to consent to disclosure of their records for the purpose of care coordination;

These changes are significant because they continue to move Part 2 regulations toward a focus on supporting whole-person care, improving outcomes, bending the healthcare cost curve, reducing stigma, and treating patients with SUD in parity with patients that have other medical conditions.

Here is a summary of the latest Final Rule to help guide providers as they evaluate/adjust processes and workflows to comply with and optimize the rule.

Read: Netsmart Summary: SAMHSA July 2020 Final Rule Amending 42 CFR Part 2

Passage of the Protecting Jessica Grubb’s Legacy Act

Jessica Grubb died in 2016 at age 30 from an overdose of oxycodone after being prescribed the medication at discharge from a hospital following surgery. Despite letting doctors know she was in recovery from an opioid addiction, the information was not listed on her chart.

The Jessica Grubb’s Legacy Act (the Legacy Act) passed as part of the CARES Act in March. The Legacy Act includes significant statutory amendments that align 42 CFR Part 2 regulations more closely with HIPAA, while retaining strong penalties for violations and adding penalties for information breaches. Netsmart played a leading role in a coalition of patient advocacy and other organizations successfully advocating for passage of the Legacy Act.

Read: Netsmart Summary: The Legacy Act

Are the two related?

The latest SAMHSA Final Rule discussed above is related to a SAMHSA Notice of Proposed Rulemaking issued Aug. 26, 2019 and is not linked to the passage of the Legacy Act. Provisions outlined in the Final Rule will be in effect until SAMHSA issues an updated new Final Rule in 2021 related to the Legacy Act as required by law.

Netsmart advocacy on behalf of our clients

Netsmart has been a long-time advocate for updating 42 CFR Part 2 regulations to provide the ability for a person with a SUD or a history of diagnosis, treatment or referral for SUD to easily consent to share their substance use treatment health data with their treating providers, while also retaining strong privacy and anti-discrimination protections and penalties. We provided input to the U.S. Department of Health and Human Services and SAMHSA in the previous Part 2 rulemaking processes on this topic and will continue that involvement as SAMHSA initiates the Final Rule process for the Legacy Act.