January 19, 2017
Yesterday, over 29 years since the last significant changes in the regulations under 42 CFR Part 2, new final regulations were issued regarding confidentiality of alcohol and drug abuse information, referred to as “substance use disorder” records and information under the new regulations. Many of the terms included in the new regulations are similar to those included in the proposed regulations issued in 2016, but there are also a number of changes. The regulations become effective February 17, 2017. Providers should begin assessing existing policies and procedures as soon as possible to facilitate changes that will be required under the new regulations.
PRIMARY CHANGES AND NEW REQUIREMENTS
- Security Policies and Procedures – The final regulations include standards mandating that covered programs and others holding information covered under the regulations maintain formal policies and procedures addressing security of substance use disorder information. The regulations require policies addressing physical security, destruction of records and electronic media and other issues. Many of the standards are similar to the requirements under the HIPAA security standards, but providers should review their policies and procedures to ensure they adequately address the new requirements.
- Standards for Disposition of Records by Discontinued Programs – The final regulations adopt many of the requirements included in earlier proposed regulations relating to management of records where a covered program discontinues operations or is taken over or acquired by another program.
- Privacy Notices – The final regulations require that patients admitted to a covered program be given a notice summarizing the federal law and regulations relating to substance use disorder patient records, including information regarding the limited exceptions that apply permitting disclosures without the patient’s consent. This notice must include details that might not be found in a typical HIPAA notice of privacy practices.
- Consents for Use and Disclosure – Perhaps the most significant changes under the new regulations are the modifications to the standards for consents/authorizations for disclosures. The current regulations under 42 CFR Part 2 include a number of requirements relating to the form of consent/authorization that present significant hurdles for sharing of information within integrated delivery systems, health information exchanges and similar structures. The new regulations modify these current standards to allow consents/authorizations to permit disclosures to an HIE, for example, if the HIE is named and the consent includes a general reference to participants in the HIE who treat the patient. Covered programs should review their current practices relating to use and disclosure of substance use disorder patient records and review use and disclosure consent/authorization forms to ensure they conform to the new regulations.
- Notices Accompanying Records – The regulations would update the language that must be included with records disclosed with a patient’s consent under 42 CFR Part 2.
- Research – As compared to the current regulations under 42 CFR part 2, the new final regulations expand permissible disclosures of covered records for research purposes. Disclosures of records for research must still comply with the requirements of HIPAA.
- List of Disclosures – Consistent with the earlier proposed regulation, the final regulations include provisions allowing a patient to obtain a list of disclosures made under a general designation during the two year period prior to the patient’s request. Where a covered program discloses information pursuant to a general designation in a consent form, the patient must be given notice of his or her right to obtain a list of disclosures made under that general designation.
In the preamble to the new regulations, SAMHSA (the Substance Abuse and Mental Health Services Administration) indicates that it expects to issue additional guidance in the future. However, given the effective date of the new regulations, providers are advised to begin work on updating their policies and procedures as soon as practicable.
If you have any questions about this new final rule, please contact Bill Hall, Molly Huffman or Mark Watson at 804-967-9604.
The information contained in this advisory is for general educational purposes only. It is presented with the understanding that neither the author nor Hancock, Daniel & Johnson, P.C., PC, is offering any legal or other professional services. Since the law in many areas is complex and can change rapidly, this information may not apply to a given factual situation and can become outdated. Individuals desiring legal advice should consult legal counsel for up-to-date and fact-specific advice. Under no circumstances will the author or Hancock, Daniel & Johnson, P.C., PC be liable for any direct, indirect, or consequential damages resulting from the use of this material.
