As revised, this regulation changes the definition of a part 2 “record.” This is a significant change.

The definition now excludes information conveyed orally by a part 2 program to a non-part 2 provider for treatment purposes, with the consent of the patient, from the definition of “record.”

This revised definition, in combination with § 2.12, means that when a part 2 program provides oral information to a non-part 2 provider and that non-part 2 provider reduces the information to written form and includes it in the non-part 2 provider’s records, that writing will not be a part 2 record merely by creating the written record.

In comments to the regulations, SAMHSA made clear that this revision to part 2 will not immunize the misconduct of a non-part 2 provider who engages in the wholesale transcription of a part 2 patient record without a direct patient encounter and without clinical purpose.²

42 C.F.R. § 2.16 pertains to security for records, while § 2.19 addresses the disposition of records by discontinued programs.

These sections were not amended but are impacted by amendments to other sections.

SAMHSA noted that “[r]ead together, current §§ 2.11, 2.16, and 2.19 could be interpreted to mean that, if an individual working in a part 2 program receives a text or email from a patient on his or her personal phone which he or she does not use in the regular course of employment in the part 2 program, and this part 2 program is discontinued, then the personal device may need to be sanitized. Depending on the policies and procedures of the part 2 program, this sanitization may render the device no longer useable to that individual.”⁴

Recognizing that part 2 patients may direct a text or an email to the personal device of an individual with a part 2 program, the preamble to the regulations provides guidance on “sanitizing” records located in a personal email account or on the personal phone of a part 2 employee, volunteer or trainee, stating that:

“…in the case a patient contact is made through an employee’s (or volunteer’s or trainee’s) personal email, or cell phone account, which he or she does not use in the regular course of business for that part 2 program, the employee should immediately delete this information from his or her personal account, and only respond via an authorized channel provided by the part 2 program, unless responding directly from the employee’s account is required in order to protect the best interest of the patient. If the email or text contains patient identifying information, the employee should forward this information to such authorized channel and then delete the email or text from any personal account. These authorized channels are then subject to the normal standards of sanitization under §§ 2.16 and 2.19 and any other applicable federal and state laws.”⁵

SAMHSA makes clear, however, that it does not encourage patient communications through personal employee email accounts or cell phones.

SAMHSA has indicated this change may result in a part 2 program disclosing more information to certain entities but anticipates there will be a decreased burden on patients by removing barriers to sharing their own information in order to receive benefits, services, or treatment.

SAMHSA also notes that commenters to the 2019 proposed rule argued that both the part 2 provider and the non-part 2 provider should make the possible increased disclosure clear to patients by explaining that when a patient consents to the release of a part 2 record to a non-part 2 provider, he or she must understand that he/she is not simply consenting to use of the information for a one-time conversation with the non-part 2 provider but rather is consenting to the information potentially becoming a part of his/her main medical record.

SAMHSA indicated that it is considering opportunities for further guidance, and patient and provider education, in connection with the additional part 2 rules to be developed under the CARES Act.

Further, SAMHSA stated that access to part 2 records must be provided in harmony with other applicable laws which restrict access, such as Jessie’s Law, which was enacted as section 7051 of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act) (P.L. 115-271). As stated by SAMHSA, Jessie’s Law calls for the development and dissemination of best practices around the display of an opioid use disorder diagnosis in health care records.⁶

SAMHSA indicated that it will continue to work within the U.S. Department of Health and Human Services to ensure that SAMHSA is complying with any applicable legal requirements stemming from Jessie’s Law.⁷

The content of the notice required with a disclosure of a part 2 record was revised.

As amended, the two alternative written notices now read as follows:

1. This record which has been disclosed to you is protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of this record unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed in this record or, is otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see § 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65;
2. 42 CFR part 2 prohibits unauthorized disclosure of these records.

SAMHSA learned through comments from the provider community that downstream non-part 2 providers who were recipients of part 2 records were manually redacting records that identify a patient as having or having had a SUD. SAMHSA stated that this was not the intent of the language in the notice. Because changes to section 2.12 make clear that certain oral transmissions reduced to a writing by a non-part 2 provider are not “records” under part 2, and further that a non-part 2 provider can segment the part 2 portions of the medical record, SAMHSA believes such redactions will not be necessary.

SAMHSA “added language to [the notice] to specifically state that only the part 2 record is subject to the prohibition on redisclosure in § 2.32.”⁸

SAMHSA believes that the revised notice removes prior language that contributed to confusion regarding the restriction on redisclosure. Based on further revisions to part 2 to implement the CARES Act, we expect further revisions to the notice requirement.

This regulation was revised to add care coordination and case management to the list of seventeen examples of permissible disclosures to a lawful holder’s contractors, subcontractors, and/or legal representatives for the purpose of payment or health care operations on behalf of the lawful holder, when the disclosure is necessary to carry out the stated purpose of the disclosure.

SAMHSA stated that it “does expect that additional payment and health care operations activities beyond those explicitly named would be permitted under § 2.33, and thus we are finalizing our proposal to add a final item to the list, indicating that other payment and health care operations activities not expressly prohibited are also allowed.”⁹

As revised, this regulation allows non-Opioid Treatment Program providers with a treating provider relationship with the patient to be eligible to query a central registry to determine whether the patient is already receiving treatment through a program to prevent duplicative enrollments and prescriptions for methadone or buprenorphine, as well as to prevent any adverse effects with other prescribed medications.

However, the part 2 program can only share information with a registry if the patient consents.¹⁰

This regulation prohibits redisclosure or use of patient identifying information disclosed under § 2.34 for purposes other than for the prevention of multiple enrollments or to ensure appropriate coordination of care with a treating provider that is not a part 2 provider, unless authorized by a court.

This allows a treating provider to check a central registry to confirm the appropriateness of a prescribed therapy.

SAMHSA acknowledged some commenters’ concerns that expanding the ability of non-part 2 treating providers to query central registries risks patient privacy and increases stigma and harm. In response, SAMHSA emphasized the importance of care coordination with non-part 2 programs to avoid multiple enrollments and prescriptions for excessive opioids and to prevent adverse effects of drug interactions with other needed medications, ultimately improving the quality and safety of care for SUD patients.

SAMHSA further stated that care coordination and increased access to information among the patient’s care team will reduce stigma by giving providers accurate and comprehensive information about a patient’s medical needs; however, the part 2 program will likely need to update its consent forms to secure patient consent for this disclosure.

SAMHSA believes such reporting would “allow for greater patient safety, better patient treatment, and better care coordination.”¹¹

If a part 2 program wishes to report data to a PDMP, the program will likely need to update its consent forms to secure patient consent for this disclosure.

This change will help to ensure appropriate clinical communications and patient care during times of natural and major disasters in addition to the current exception that allows for such communication in the event of a medical emergency.¹²

Although patient consent is not needed for these disclosures, providers under their own policies and procedures or other laws may need to keep track of the disclosures made, which could require additional paperwork.

SAMHSA reiterated that consent should still be obtained if feasible, but appropriate care should be the priority in these scenarios.

This change coordinates requirements of part 2 with HIPAA and the Common Rule to ensure appropriate disclosures for research purposes.¹³

The portion of the 2019 Proposed Rule that was not finalized pertained to disclosures to a member of the workforce of a HIPAA covered entity for “employer-sponsored” research. Some commenters expressed concern about the scope of “employer-sponsored” research, as well as confusion around the purpose for such a change.

This section finalized language to clarify that:

1. audits and evaluations may include reviews of appropriateness of medical care, medical necessity, and utilization of services;
2. part 2 programs may disclose information, without consent, to non-part 2 entities that have direct administrative over the disclosing part 2 programs; and
3. entities conducting audits or evaluations in accordance with § 2.53(a) and (b) may include accreditation or similar types of organizations focused on quality assurance.¹⁴

Further the regulation finalizes a proposal that part 2 programs are permitted to disclose patient identifying information to “government agencies in the course of conducting audits or evaluations mandated by statute or regulation, if those audits or evaluations cannot be carried out using deidentified information.”¹⁵

As revised, this section extends the period for court-ordered placement of an undercover agent or informant to investigate employees or agents of a part 2 program in connection with a criminal matter to 12 months while authorizing courts to further extend a period of placement through a new court order.

The regulation also states explicitly when the 12-month period begins to run. It begins to run “on the date that the undercover agent or informant is placed on site within the program.”