In Short
The Situation: The two-year grace period for updating agreements of "lawful holders" (i.e., recipients named on patient consent forms obtained pursuant to the Part 2 Rule) with contractors, subcontractors, and legal representatives ("Part 2 Recipients") under Substance Abuse and Mental Health Service Administration's ("SAMHSA") regulations governing the Confidentiality of Substance Use Disorder Patient Records (commonly referred to as the "Part 2 Rule") ends on February 2, 2020.
The Action: On January 3, 2018, SAMHSA amended the Part 2 Rule to provide, among other things, greater flexibility on sharing substance use disorder patient records that are subject to the Part 2 Rule with Part 2 Recipients. However, SAMHSA required lawful holders to include provisions expressly requiring compliance with the Part 2 Rule in agreements with those Part 2 Recipients. To allow time for lawful holders to achieve compliance, SAMHSA established a two-year grace period that began on February 2, 2018.
Looking Ahead: On or before February 2, 2020, any lawful holder receiving records subject to the Part 2 Rule must bring their contracts and legal agreements with Part 2 Recipients into compliance, or they will not be permitted to share Part 2 records with those third parties.
On January 3, 2018, SAMHSA amended the Part 2 Rule with the stated goal of better aligning the Part 2 Rule with the advances in the U.S. health care delivery system while retaining important privacy protections for individuals seeking treatment for substance use disorders ("SUD"). SAMHSA is generally cautious with any change to the Part 2 Rule easing the restrictions on disclosures of SUD records because the risks of unauthorized disclosure could subject individuals to negative consequences, including loss of employment, housing, or child custody; discrimination by medical professionals and insurers; and arrest, prosecution, and incarceration. SAMHSA has stated that it does not want to make such individuals more vulnerable due to having a patient record for seeking treatment than individuals with SUDs who have not sought treatment.
Given the sensitive nature of these records, the Part 2 Rule is generally more stringent than the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") by permitting the disclosure of Part 2 records only under limited circumstances without specific patient consent. The requirements of that consent differ from the HIPAA requirements for patient authorizations.
Under the prior version of the Part 2 Rule, lawful holders of Part 2 records (i.e., recipients named on patient consent forms) could only share those records with Part 2 Recipients if authorized in that patient consent. However, the 2018 amendments allow lawful holders to share Part 2 records with its Part 2 Recipients for payment and health care operations if the patient consent allows the lawful holder to use the records for those purposes.
Importantly, the amendment does not extend to other purposes, such as activities related to a patient's diagnosis, treatment, or referral for treatment. Notably, the terms treatment, payment, and health care operations under the Part 2 Rule do not have the same meanings that those terms have under HIPAA. For example, in contrast to HIPAA, the Part 2 Rule's term, health care operations, does not include case management and care coordination.
To allow for compliance with this contractual requirement, SAMHSA established a two-year grace period that began on February 2, 2018 and will come to an end as of February 2, 2020. After that date, lawful holders will not be able to share Part 2 records with their Part 2 Recipients unless the mandatory compliance language is in place.
Despite this newly permitted flexibility in sharing Part 2 records, the 2018 amendments only allow lawful holders to disclose Part 2 records to their Part 2 Recipients for payment or health care operation purposes if they include specific contractual provisions requiring compliance with the Part 2 Rule. SAMHSA will not permit the parties to meet this obligation with contractual language regarding general compliance with applicable federal laws. While SAMHSA has declined to specify the exact contractual language that must be used, the Part 2 Rule must be specifically mentioned in the contractual provision. Additionally, the provision must otherwise meet the requirements in 42 C.F.R. § 2.33, including by requiring that recipients implement appropriate safeguards to prevent unauthorized uses and disclosures and that the recipients report any unauthorized uses, disclosures, or breaches of patient identifying information to the lawful holder.
While the specific Part 2 Rule compliance language to be included in agreements is a matter of private contracting, the parties will want to carefully craft this language to ensure that the Part 2 records are used and disclosed consistent with the Part 2 Rule and the applicable patient consent. The parties may also want to consider fleshing out some of the Part 2 Rule's requirements, such as the mechanism for reporting to the lawful holder any unauthorized uses, disclosures, or breaches to ensure its Part 2 Recipients understand their Part 2 Rule obligations. Other contractual language may be helpful in negotiating with Part 2 Recipients, such as representations and warranties from the lawful holder that the patient consent authorized the use and disclosure of the Part 2 records for payment and/or health care operation purposes.
The parties must also ensure that they understand the requirements of the Part 2 Rule as it pertains to their particular arrangement. By way of example only, lawful holders using cloud service providers that make Part 2 records available to Part 2 Recipients via the cloud must still establish a mechanism for providing the required notice of the prohibition on redisclosure to those third parties. Finally, as always required, the parties should ensure that they are only sharing the information necessary to carry out the purpose of the disclosure.
Three Key Takeaways
- With the two-year grace period coming to an end as of February 2, 2020, lawful holders must ensure that they have updated their agreements with language requiring compliance with the Part 2 Rule to avoid any disruptions in data sharing.
- In amending their agreements to include the Part 2 compliance provision, the parties should carefully consider their particular arrangement and tailor the provision to include the appropriate obligations, safeguards, and reporting mechanism to effectively implement the Part 2 Rule's requirements.
- Given that many potential Part 2 Recipients may be unfamiliar with the Part 2 Rule (in contrast to the greater awareness of HIPAA in the health care and insurance industries), it may be necessary for the lawful holders to educate their Part 2 Recipients on the Part 2 Rule to avoid violations of the Part 2 Rule or breaches of their Part 2 Rule contractual obligations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
