Client Alert: New SAMHSA Requirements May Necessitate Changes to Business Associate Agreements

Shumaker, Loop & Kendrick, LLP
Contact

Shumaker, Loop & Kendrick, LLP

42 C.F.R. Part Two (“Part 2”) addresses the protection of substance use disorder (SUD) patient records, which are records held by SUD treatment programs that receive federal financial assistance (e.g., from Medicare or Medicaid). The Substance Abuse and Mental Health Services Administration (SAMHSA) issued final regulations concerning the confidentiality of these records. The regulations provide that when a patient consents to a disclosure of their SUD records for payment or health care operations, a treatment program may share them with a “lawful holder,” who may then share them with a third-party vendor or subcontractor. As part of this disclosure, the lawful holder must have specific language incorporated into its contract with the third-party vendor that references Part 2 compliance.

Not all Business Associate Agreements (BAA) are affected by the changes to regulations governing the confidentiality of SUD patient records.

The requirements apply only to plans actually receiving SUD records from a treatment program that receives federal financial assistance. For example, if an employer-sponsored group health plan receives certain types of SUD patient records and discloses these records to a vendor for purpose of payment or health care operations, the relevant BAA will need to contain language requiring the business associate to comply with these regulations.

Existing BAAs should already address the elements required by 42 C.F.R. Part 2; therefore, it’s not necessary for BAAs to be amended to include specific references to the new provisions. Instead, BAAs should be updated to include language that directly references “compliance with 42 C.F.R. Part 2 requirements.” This may be as simple as adding a sentence in the portion of the BAA that discusses compliance with applicable laws and regulations that specifically provides that the business associate is required to comply with 42 C.F.R. Part 2.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Shumaker, Loop & Kendrick, LLP | Attorney Advertising

Written by:

Shumaker, Loop & Kendrick, LLP
Contact
more
less

Shumaker, Loop & Kendrick, LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.