The final rule governing changes to the Substance Abuse and Mental Health Services Administration (SAMHSA) regulations became effective February 2, 2018.
What is SAMHSA?
The federal SAMHSA regulations (42 CFR Part 2) protect the confidentiality of records for people seeking treatment for substance use disorders from federally assisted programs. Generally, the SAMHSA regulations require a federally assisted substance use program to have a patient’s consent before releasing information to others. The law encourages people to seek treatment and reassures patient privacy.
Background on changes
In 2017, SAMHSA issued a final rule to update and modernize the law (which had not changed significantly since 1987). The changes were intended to facilitate information exchange within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder.
With the 2017 final rule, SAMHSA concurrently issued a supplemental notice of proposed rulemaking that proposed additional clarifications to the SAMHSA regulations as amended by the 2017 final rule. The proposed rule sought to clarify how lawful holders and their contractors and subcontractors could use and disclose protected information for purposes of carrying out payment, health care operations, and other health care related activities.
Highlights of the 2018 final rule
Highlights of the 2018 final rule include the following:
- The final rule permits, with patient consent, disclosures by lawful holders to contractors, subcontractors, and legal representatives for payment and health care operations (such as claims management, quality assessment, and patient safety activities).
- The rule requires certain protections to be put in place with respect to such disclosures (e.g., contractual provisions, safeguards, prohibitions on re-disclosure).
- This does not allow disclosures for care coordination or case management or disclosures for diagnosis, treatment or referral for treatment.
- The final rule permits, without patient consent, disclosures by lawful holders to contractors, subcontractors, and legal representatives for certain audit and evaluation activities.
- SAMHSA regulations require a re-disclosure prohibition notice to accompany each disclosure made with the patient’s consent. The final rule allows an abbreviated re-disclosure prohibition notice to be used. This revised notice alleviates concerns about character limits in free-text fields within electronic health record systems.
Conclusion
While these changes are intended to relax some of the strict protections in the SAMHSA regulations, providers and health plans with protected information must still overcome significant hurdles to comply with the law’s protections.
Nicole Jobe is an associate in Thompson Coburn's health care practice.