Skip to main content
Article | Insider

Substance use disorder confidentiality rules may impact contracts

Benefits Administration and Outsourcing Solutions|Health and Benefits
N/A

By Maureen Gammon and Kathleen Rosenow | March 12, 2020

Recipients of SUD patient records who lawfully re-disclose them must have written contracts that comply with the confidentiality rules.

In 2018, the Substance Abuse and Mental Health Services Administration (SAMHSA), a branch of the Department of Health and Human Services, amended regulations protecting the confidentiality of certain substance use disorder (SUD) patient records. The amendments allow the records to be shared for payment and/or health care operations activities if specific requirements are met. Recipients of SUD patient records needing to re-disclose those records for payment and/or health care operations — including employers sponsoring group health plans that want to share those records with their contractors, subcontractors or legal representatives who carry out payment and/or health care operation activities on their behalf — must comply with the regulations.

Effective February 2, 2020, under the amended rules, written agreements between the parties must include specific language that complies with the SUD confidentiality regulations.

Background

The Confidentiality of Substance Use Disorder Patient Records Final Rule (42 CFR Part 2) protects the confidentiality of SUD patient records held by SUD treatment programs receiving federal funding and limits how such records may be used or disclosed. In general, it prohibits the disclosure of SUD patient records without written patient consent, even for the purposes of treatment, payment or health care operations.

In an effort to provide greater flexibility on sharing patient records while still protecting confidentiality, Part 2 regulations were amended in 2017 and again in 2018 to expand on the circumstances under which SUD patient records may be disclosed. Prior to these amendments, lawful holders of Part 2 patient records (i.e., recipients of patient information who are named in the patient consent form) were only permitted to share the records if authorized to do so in the patient consent form.

Part 2 amendments

Under the 2018 regulations, lawful recipients are permitted to further disclose those records to their contractors, subcontractors or legal representatives in order to perform the payment and/or health care operation functions designated on the consent form, such as billing, claim management, collections activities, obtaining payment under a contract for reinsurance, claim filing and related health care data processing. Note that the 2018 regulations do not affect the requirements for disclosures related to diagnosis, treatment or referral.

As of February 2, lawful recipients of SUD patient records who wish to re-disclose them for payment and/or health care operations must:

  • Have a written contract or other legal instrument with the contractor, subcontractor or legal representatives that states they will comply with Part 2’s requirements when they receive SUD patient records. Contractual language regarding general compliance with applicable federal laws is not sufficient for this purpose: Part 2 must be specifically mentioned in the contract. Only information necessary for performance of duties under the terms of the contracts can be disclosed to the contractor, subcontractor or legal representative.
  • Require contractors, subcontractors or legal representatives to take reasonable steps to prevent unauthorized uses and disclosures and to report on any unauthorized uses, disclosures or breaches of patient-identifying information.
  • Provide contractors, subcontractors or legal representatives with a notice prohibiting re-disclosure that is mandated by   Part 2.

If lawful holders choose not to re-disclose patient identifying information to contractors, subcontractors or legal representatives, then these requirements do not apply.

Going forward

Group health plan sponsors who receive and may need to share SUD patient records with any third-party vendor for purposes of payment or health care operations activities should review the confidentiality requirements, ensure that the third-party vendor is aware of its compliance obligations and confirm that there is a written agreement between the parties with the necessary Part 2 language.

Download
Title File Type File Size
Insider March 2020 PDF .5 MB
Authors

Senior Regulatory Advisor, Health and Benefits

Senior Regulatory Advisor, Health and Benefits

Contact Us