Wading through SAMHSA’s Long-Awaited 42 CFR Part 2 Reg

If you’re a true “Reg Head,” like me, you were eagerly awaiting the U.S. Department on Health and Human Services (HHS) to release the Substance Abuse and Mental Health Services Administration (SAMHSA) proposed reg to modify 42 CFR Part 2. For those who are just diving into health care regs, 42 CFR Part 2 governs the confidentiality of patient records for the treatment of substance use disorder (SUD). On August 22nd, SAMHSA finally issued the proposed reg.

One of the major policy debates around 42 CFR Part 2 has been whether this set of regulations should be modified to align more closely with HIPAA. Currently, under 42 CFR Part 2 requirements, the sharing of medical records for patients seeking treatment for SUD requires patient consent except under limited circumstances, including bona fide medical emergencies. Conversely, under HIPAA, health care providers and other “covered entities” can use protected health information about a patient for treatment, payment, or health care operations without the patient’s consent. There are differing opinions on whether the 42 CFR Part 2 patient consent requirements should more closely match with the HIPAA requirements, and therefore many stakeholders were anxiously waiting to see if SAMHSA would propose such an alignment in the reg. However, the long-awaited reg DOES NOT do so. In fact, when releasing the reg, HHS leadership stated that they do not believe that the Department actually has the legal authority to completely align 42 CFR Part 2 and HIPAA and that congressional action is necessary.

Instead, SAMHSA proposes smaller modifications to 42 CFR Part 2 aimed at advancing care coordination for patients with SUD and clarifying existing policies for 42 CFR Part 2 treatment Programs (federally assisted alcohol or drug abuse programs) and other health care providers. Some of the major proposals include:

• Clarify under what circumstances 42 CFR Part 2 requirements apply to non-42 CFR Part 2 entities;
• Codify a list of 17 examples of “payment and health care operations” for which disclosure is permitted with written consent and clarify that this list of activities is not intended to cover care coordination or case management;
• Allow opioid treatment programs (OTPs) to enroll in state prescription drug monitoring programs (PDMPs) and submit data consistent with applicable state laws;
• Allow non-OTPs to query a central registry to determine whether patients are already receiving SUD treatment through a member program;
• Broaden the bona fide medical emergencies exception to include declared emergencies from natural disasters that disrupt treatment facilities and service; and
• Broaden the research exception to include disclosures by a HIPAA-covered entity or business associate to individuals and entities who are not covered by HIPAA or the common rule (regarding research on human subjects).

ACEP recognizes that the current 42 CFR Part 2 requirements may be confusing to those who provide treatment to patients with SUD. We are still reviewing this proposed reg to see if it provides the needed clarity to help you better serve your patients. In the meantime, we would love to hear your thoughts on the reg! If you have any comments or feedback, please send them to me at jdavis@acep.org. Comments on the reg are due on October 25.

Until next week, this is Jeffrey saying, enjoy reading regs with your eggs!