The Practitioner’s Guide to SAMHSA’s 2020 Final Part 2 Rules – More Changes on the Horizon

12 Agustus 2020

As we previously reported, the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) overhauled 42 U.S.C. §290dd–2, commonly referred to as “part 2.” Part 2 regulates the confidentiality of substance use disorder (SUD) records.

The Substance Abuse and Mental Health Services Administration (SAMHSA) is required to publish new rules to implement the CARES Act changes. Those new rules will be effective no earlier than March 27, 2021. The anticipated CARES Act changes will more closely align part 2 regulations with the regulations related to use and disclosure of protected health information under the Health Insurance Portability and Accountable Act of 1996 (HIPAA).

However, while waiting for the new CARES Act rules, on July 15, 2020 SAMHSA finalized the proposed rule it had issued in August of 2019. SAMHSA stated that the changes implemented in this final rule (the 2020 Final Rule) are necessary to continue to align part 2 with advances in the U.S. health care delivery system, while protecting SUD records. The 2020 Final Rule is effective on August 14, 2020 and will “serve as interim and transitional standards, until regulations conforming to the CARES Act legislation can be promulgated.”1 Key dates are as follows.

The 2020 Final Rule implements changes that allow disclosure to a wider range of entities without requiring that a specific individual at the entity be named in the patient consent, as well as outlining specific instructions for disclosures to health information exchanges and research institutions.

Notably, the 2020 Final Rule adds disclosures for the purpose of care coordination and case management to the list of permissible payment and health care operations disclosures. As a result, the 2020 Final Rule will require updated patient consent forms and policies, as well as staff and provider training. The 2020 Final Rule also provides guidance on the segregation of part 2 information received by a non-part 2 provider within the non-part 2 provider’s records.

This article identifies some of the significant changes in the 2020 Final Rules and highlights the impact of those changes in the following table:

Regulation Summary of Change Comment
§ 2.11

As revised, this regulation changes the definition of a part 2 “record.” This is a significant change.

The definition now excludes information conveyed orally by a part 2 program to a non-part 2 provider for treatment purposes, with the consent of the patient, from the definition of “record.”

This revised definition, in combination with § 2.12, means that when a part 2 program provides oral information to a non-part 2 provider and that non-part 2 provider reduces the information to written form and includes it in the non-part 2 provider’s records, that writing will not be a part 2 record merely by creating the written record.

In comments to the regulations, SAMHSA made clear that this revision to part 2 will not immunize the misconduct of a non-part 2 provider who engages in the wholesale transcription of a part 2 patient record without a direct patient encounter and without clinical purpose.2

§ 2.12 Establishes that records containing SUD patient information created by a non part 2 provider will not be covered by part 2, unless a SUD record previously received from a part 2 program is incorporated into the non part 2 provider’s records. “Taken together, the effect of the revisions to §§ 2.11 and 2.12 is to cause both oral and non-oral communications made by a part 2 program to a non-part 2 provider to be treated in the same way under the regulations. In each instance, the intent is to allow the part 2 program to make a disclosure, with the patient’s consent, to the recipient non-part 2 provider. In turn, the non-part 2 provider can then carry out her own encounter with the patient, and create her own patient record, which will not fall under the coverage of part 2. [Segregation of any received SUD record may be used by a non-part 2 provider to ensure that her own created records can be distinguished, and will therefore not become subject to part 2.”3
§§ 2.16 and 2.19

42 C.F.R. § 2.16 pertains to security for records, while § 2.19 addresses the disposition of records by discontinued programs.

These sections were not amended but are impacted by amendments to other sections.

SAMHSA noted that “[r]ead together, current §§ 2.11, 2.16, and 2.19 could be interpreted to mean that, if an individual working in a part 2 program receives a text or email from a patient on his or her personal phone which he or she does not use in the regular course of employment in the part 2 program, and this part 2 program is discontinued, then the personal device may need to be sanitized. Depending on the policies and procedures of the part 2 program, this sanitization may render the device no longer useable to that individual.”4

Recognizing that part 2 patients may direct a text or an email to the personal device of an individual with a part 2 program, the preamble to the regulations provides guidance on “sanitizing” records located in a personal email account or on the personal phone of a part 2 employee, volunteer or trainee, stating that:

“…in the case a patient contact is made through an employee’s (or volunteer’s or trainee’s) personal email, or cell phone account, which he or she does not use in the regular course of business for that part 2 program, the employee should immediately delete this information from his or her personal account, and only respond via an authorized channel provided by the part 2 program, unless responding directly from the employee’s account is required in order to protect the best interest of the patient. If the email or text contains patient identifying information, the employee should forward this information to such authorized channel and then delete the email or text from any personal account. These authorized channels are then subject to the normal standards of sanitization under §§ 2.16 and 2.19 and any other applicable federal and state laws.”5

SAMHSA makes clear, however, that it does not encourage patient communications through personal employee email accounts or cell phones.

§ 2.31 Allows patients to consent to disclosure of their part 2 information to entities without naming the specific individual receiving the information on behalf of a given entity.

SAMHSA has indicated this change may result in a part 2 program disclosing more information to certain entities but anticipates there will be a decreased burden on patients by removing barriers to sharing their own information in order to receive benefits, services, or treatment.

SAMHSA also notes that commenters to the 2019 proposed rule argued that both the part 2 provider and the non-part 2 provider should make the possible increased disclosure clear to patients by explaining that when a patient consents to the release of a part 2 record to a non-part 2 provider, he or she must understand that he/she is not simply consenting to use of the information for a one-time conversation with the non-part 2 provider but rather is consenting to the information potentially becoming a part of his/her main medical record.

SAMHSA indicated that it is considering opportunities for further guidance, and patient and provider education, in connection with the additional part 2 rules to be developed under the CARES Act.

Further, SAMHSA stated that access to part 2 records must be provided in harmony with other applicable laws which restrict access, such as Jessie’s Law, which was enacted as section 7051 of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act) (P.L. 115-271). As stated by SAMHSA, Jessie’s Law calls for the development and dissemination of best practices around the display of an opioid use disorder diagnosis in health care records.6

SAMHSA indicated that it will continue to work within the U.S. Department of Health and Human Services to ensure that SAMHSA is complying with any applicable legal requirements stemming from Jessie’s Law.7

§ 2.32

The content of the notice required with a disclosure of a part 2 record was revised.

As amended, the two alternative written notices now read as follows:

  1. This record which has been disclosed to you is protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of this record unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed in this record or, is otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see § 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65;
  2. 42 CFR part 2 prohibits unauthorized disclosure of these records.

SAMHSA learned through comments from the provider community that downstream non-part 2 providers who were recipients of part 2 records were manually redacting records that identify a patient as having or having had a SUD. SAMHSA stated that this was not the intent of the language in the notice. Because changes to section 2.12 make clear that certain oral transmissions reduced to a writing by a non-part 2 provider are not “records” under part 2, and further that a non-part 2 provider can segment the part 2 portions of the medical record, SAMHSA believes such redactions will not be necessary.

SAMHSA “added language to [the notice] to specifically state that only the part 2 record is subject to the prohibition on redisclosure in § 2.32.”8

SAMHSA believes that the revised notice removes prior language that contributed to confusion regarding the restriction on redisclosure. Based on further revisions to part 2 to implement the CARES Act, we expect further revisions to the notice requirement.

§ 2.33

This regulation was revised to add care coordination and case management to the list of seventeen examples of permissible disclosures to a lawful holder’s contractors, subcontractors, and/or legal representatives for the purpose of payment or health care operations on behalf of the lawful holder, when the disclosure is necessary to carry out the stated purpose of the disclosure.

SAMHSA stated that it “does expect that additional payment and health care operations activities beyond those explicitly named would be permitted under § 2.33, and thus we are finalizing our proposal to add a final item to the list, indicating that other payment and health care operations activities not expressly prohibited are also allowed.”9

Although the list of examples of activities for which a lawful holder of part 2 records may redisclose to contractors, subcontractors, or legal representatives has been expanded to include care coordination and case management, this disclosure is for the purpose of payment or health care operations where the patient consents to the initial disclosure and where the lawful holder’s redisclosure is for the purposes of such contractor, subcontractor, or legal representative’s carrying out payment or health care operations activities on behalf of the lawful holder.
§ 2.34

As revised, this regulation allows non-Opioid Treatment Program providers with a treating provider relationship with the patient to be eligible to query a central registry to determine whether the patient is already receiving treatment through a program to prevent duplicative enrollments and prescriptions for methadone or buprenorphine, as well as to prevent any adverse effects with other prescribed medications.

However, the part 2 program can only share information with a registry if the patient consents.10

This regulation prohibits redisclosure or use of patient identifying information disclosed under § 2.34 for purposes other than for the prevention of multiple enrollments or to ensure appropriate coordination of care with a treating provider that is not a part 2 provider, unless authorized by a court.

This allows a treating provider to check a central registry to confirm the appropriateness of a prescribed therapy.

SAMHSA acknowledged some commenters’ concerns that expanding the ability of non-part 2 treating providers to query central registries risks patient privacy and increases stigma and harm. In response, SAMHSA emphasized the importance of care coordination with non-part 2 programs to avoid multiple enrollments and prescriptions for excessive opioids and to prevent adverse effects of drug interactions with other needed medications, ultimately improving the quality and safety of care for SUD patients.

SAMHSA further stated that care coordination and increased access to information among the patient’s care team will reduce stigma by giving providers accurate and comprehensive information about a patient’s medical needs; however, the part 2 program will likely need to update its consent forms to secure patient consent for this disclosure.

§ 2.36 (new) This is a new section. This section permits part 2 programs and other lawful holders to report any SUD medication prescribed or dispensed by a part 2 program to Prescription Drug Monitoring Programs (PDMPs), as required by the applicable state law, with patient consent.

SAMHSA believes such reporting would “allow for greater patient safety, better patient treatment, and better care coordination.”11

If a part 2 program wishes to report data to a PDMP, the program will likely need to update its consent forms to secure patient consent for this disclosure.

§ 2.51 This section allows disclosure of patient information without consent, when consent cannot be obtained, during natural and major disasters, during which times access to providers and needed treatment may be disrupted.

This change will help to ensure appropriate clinical communications and patient care during times of natural and major disasters in addition to the current exception that allows for such communication in the event of a medical emergency.12

Although patient consent is not needed for these disclosures, providers under their own policies and procedures or other laws may need to keep track of the disclosures made, which could require additional paperwork.

SAMHSA reiterated that consent should still be obtained if feasible, but appropriate care should be the priority in these scenarios.

§ 2.52 This regulation allows research disclosures of part 2 data from a HIPAA-covered entity or business associate to individuals and organizations who are neither HIPAA-covered entities nor subject to the Federal Policy for the Protection of Human Subjects (also known as the Common Rule), provided any such data is disclosed in accordance with the HIPAA Privacy Rule.

This change coordinates requirements of part 2 with HIPAA and the Common Rule to ensure appropriate disclosures for research purposes.13

The portion of the 2019 Proposed Rule that was not finalized pertained to disclosures to a member of the workforce of a HIPAA covered entity for “employer-sponsored” research. Some commenters expressed concern about the scope of “employer-sponsored” research, as well as confusion around the purpose for such a change.

§ 2.53 This regulation was revised to clarify permitted disclosures for audits and evaluations described in the regulation for activities undertaken by a federal, state, or local governmental agency or third-party payer to identify needed actions to improve the delivery of care, to manage resources effectively to care for patients, or to determine the need for adjustments to payment policies to enhance care or coverage for patients with SUD.

This section finalized language to clarify that:

  1. audits and evaluations may include reviews of appropriateness of medical care, medical necessity, and utilization of services;
  2. part 2 programs may disclose information, without consent, to non-part 2 entities that have direct administrative over the disclosing part 2 programs; and
  3. entities conducting audits or evaluations in accordance with § 2.53(a) and (b) may include accreditation or similar types of organizations focused on quality assurance.14

Further the regulation finalizes a proposal that part 2 programs are permitted to disclose patient identifying information to “government agencies in the course of conducting audits or evaluations mandated by statute or regulation, if those audits or evaluations cannot be carried out using deidentified information.”15

§ 2.67

As revised, this section extends the period for court-ordered placement of an undercover agent or informant to investigate employees or agents of a part 2 program in connection with a criminal matter to 12 months while authorizing courts to further extend a period of placement through a new court order.

The regulation also states explicitly when the 12-month period begins to run. It begins to run “on the date that the undercover agent or informant is placed on site within the program.”

This change aims to ensure that the rules are not overly burdensome on law enforcement investigations of part 2 programs.16
Patient and Provider Education SAMHSA noted that patient and staff education about the changes will be required. Of note, SAMHSA commented that it is considering opportunities for guidance and educational outreach in connection with §§ 2.11 and 2.12 specifically and the new part 2 rules more broadly. SAMHSA estimates one hour per staff member training regarding these new rules.17


As a reminder, the revised regulations discussed in this alert do not implement the changes required by the CARES Act—those changes are coming. It also seems clear that SAMHSA is attempting to draft changes to the part 2 rules that balance the requirements of the CARES Act with Jessie’s Law and SAMHSA’s responsibilities under 42 U.S.C. 290dd–2.