42 C.F.R. Part Two (“Part 2”) addresses the protection of substance use disorder (SUD) patient records, which are records held by SUD treatment programs that receive federal financial assistance (e.g., from Medicare or Medicaid). The Substance Abuse and Mental Health Services Administration (SAMHSA) issued final regulations concerning the confidentiality of these records. The regulations provide that when a patient consents to a disclosure of their SUD records for payment or health care operations, a treatment program may share them with a “lawful holder,” who may then share them with a third-party vendor or subcontractor. As part of this disclosure, the lawful holder must have specific language incorporated into its contract with the third-party vendor that references Part 2 compliance.

Not all Business Associate Agreements (BAA) are affected by the changes to regulations governing the confidentiality of SUD patient records.

The requirements apply only to plans actually receiving SUD records from a treatment program that receives federal financial assistance. For example, if an employer-sponsored group health plan receives certain types of SUD patient records and discloses these records to a vendor for purpose of payment or health care operations, the relevant BAA will need to contain language requiring the business associate to comply with these regulations.

Existing BAAs should already address the elements required by 42 C.F.R. Part 2; therefore, it’s not necessary for BAAs to be amended to include specific references to the new provisions. Instead, BAAs should be updated to include language that directly references “compliance with 42 C.F.R. Part 2 requirements.” This may be as simple as adding a sentence in the portion of the BAA that discusses compliance with applicable laws and regulations that specifically provides that the business associate is required to comply with 42 C.F.R. Part 2.