Federal Government Issues New Rule on SUD Records

Part 2 now allows patients to sign a single consent form for all future uses and disclosures for SUD treatment, payment, and other health care operations. APA supported this provision to help with care coordination, and it may reduce patients’ paperwork burden as well, Das pointed out.

The new rule allows HIPAA-covered entities and business associates that receive records under this single consent to redisclose the records in accordance with the HIPAA regulations without requiring patients to re-consent.

The new rule expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings conducted against a patient unless the patient provides consent or a court order is issued. APA advocated for this provision to help eliminate stigma against seeking care.

When agencies investigate or prosecute Part 2 programs or individuals providing care under Part 2, they may unknowingly receive confidential, protected records before obtaining a court order. The updated rule creates new, stronger diligence steps that investigational agencies must follow before they are eligible for a safe harbor (a protection from civil or criminal liability) under Part 2. Investigational agencies must look for a health professional in SAMHSA’s online treatment facility locator and check a professional’s patient notice or HIPAA notice of privacy practices to determine whether the health professional is subject to Part 2.

Previously, health professionals were required to track and segregate records that are subject to Part 2 from those that are subject to HIPAA. For example, if a clinic provided general medical services along with services on a unit specializing in SUD treatment, the clinic had to segregate its SUD records and medical records for the same patient. Now, if consent is provided, SUD records that are shared with other general medicine units do not have to be segregated once received.

The new rule creates a new definition for an SUD clinician’s notes that are analogous to HIPAA’s protections for psychotherapy notes. Notes analyzing conversations during SUD counseling sessions that the clinician voluntarily maintains separately from the rest of the patient’s SUD treatment and medical records cannot be used or disclosed based on a broad treatment, payment, and health care operations consent. Instead, the patient must provide additional consent before these notes can be disclosed.

Records can be disclosed without patient consent to public health authorities, provided that the records are de-identified according to the standards of HIPAA’s privacy rule.