A final rule from the Substance Abuse and Mental Health Services Administration establishes requirements for the exchange of patient information between substance abuse treatment programs and their agents and contractors. Published on January 3, the rule clarifies requirements for re-disclosure of confidential patient information by certain contractors and agents of substance abuse treatment programs under the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (commonly referred to as “Part 2”). The rule permits re-disclosure of confidential patient information by lawful holders without patient consent, and sets the parameters for this re-disclosure.
Before the final rule, re-disclosures of patients’ identifying information without written consent were prohibited absent a specific exception. However, the regulations were unclear as to how lawful holders (i.e., individuals or entities who receive patients’ identifying information by virtue of a written consent) could lawfully disclose this information to their contractors, subcontractors and legal representatives for payment and/or health care operation activities. The rule clarifies the restrictions on re-disclosure and permits a lawful holder to further disclose information to its contractors, subcontractors or legal representatives in order to carry out its payment and health care operation obligations on the lawful holder’s behalf. The preamble to the final rule contains a list of activities that fall under payment or health care operations, for example billing, auditing, licensing and business planning. The agency did not include this list in the text of the regulations, which indicates some flexibility as to which activities qualify.
Although re-disclosure is permitted for payment and health care operation purposes, it not permitted for purposes of diagnosis, treatment or referral. Disclosures are still restricted to the minimum amount necessary and must be in furtherance of the disclosed purpose set forth on the original patient consent. Disclosures must be accompanied by a notice prohibiting re-disclosure as previously required by Part 2. In an effort to make this notice requirement compatible with electronic medical record systems, the final rule provides the option of an abbreviated notice as opposed to the lengthy paragraph previously required. The abbreviated notice need only state that “42 CFR part 2 prohibits unauthorized disclosure of these records.”
Lawful holders must have a written contract with the contractor or legal representative to whom they want to disclose the information. The contract must require that the recipient adhere to Part 2, implement appropriate safeguards, and report any unauthorized uses, disclosures or breaches to the lawful holder. The recipient may not further re-disclose any information to a third party unless that party is a contract agent helping the contractor or subcontractor provide the services to the lawful holder and the information received by the third party is only further disclosed back to the lawful holder or the Part 2 program.
The final rule provides certainty that necessary disclosures by lawful holders for payment and health care operation purposes will not be deemed a violation of Part 2 if the disclosures meet the requirements of the rule. Substance abuse treatment programs and their agents and contractors should reevaluate their procedures for disclosure of patient information in light of the final rule and should consult with counsel to ensure the appropriate consents, contracts and safeguards are in place.
