The federal Substance Abuse and Mental Health Services Administration (SAHMSA) published a Final Rule on January 3, 2018 making further changes to federal rules governing the confidentiality of substance use disorder patient records. Significant changes were also made in a prior final rule published on January 18, 2017. The new rule allows an abbreviated notice regarding the prohibition on re-disclosures. It also provides parameters for the circumstances under which “lawful holders” of data may re-disclose patient information to their contractors. Unlike disclosures to qualified service organizations (QSOs), disclosures to a “lawful holder” require patient consent. If a patient provides such consent for payment or healthcare operations activities, the lawful holder may further disclose the information as needed for its contractors, subcontractors or legal representatives to carry out payment or healthcare operations on behalf of the lawful holder. Such further disclosures are not permitted for purposes of diagnosis, treatment, or referral for treatment.

Interestingly, in the preamble to the rule, SAMHSA says that a QSO may re-disclose information to a third party only if the third party is a contract agent of the QSO, helping them provide services to the Part 2 program as specified in the agreement between the QSO and the program, and the agent may further disclose the information only if the disclosure is back to the QSO or the Part 2 program.