Provisions detailed in the Final Rule include:

• While SAMHSA did not finalize its proposed changes to the definition of a Part 2 program, it did make clear that health care providers do not become a "program" if it only provides screening, brief intervention or referral to treatment within the context of general health care. A federally assisted health care provider is a "program" when it holds itself out as providing substance abuse disorder diagnosis, treatment or referral for treatment.
• The definition of "records" was amended to include electronic records and now requires that Part 2 Programs have in place formal policies and procedures for the security of both paper and electronic records.
• A lawful holder of patient identifying information may disclose Part 2 patient identifying information to qualified personnel for purposes of conducting scientific research if the researcher meets certain regulatory requirements.
• A patient can consent to disclosure of information using a general designation in the "to whom" section of the consent form to individual(s) and/or entity(-ies) (e.g., "my treating providers") in certain circumstances. Additionally, a patient can authorize disclosure to a health information exchange or other intermediate entity and "my current and future treating providers." When this kind of general designation is used, the intermediate entity may further disclose the patient identifying information it receives only to those providers it can verify have a treating provider relationship with the patient.
• If a patient has agreed to the general disclosure designation, the patient can request a list of entities to which their information has been disclosed within the last two years pursuant to the general designation from the intermediate entity.
• Audit and evaluation procedures have been updated to meet the requirements of CMS-regulated Accountable Care Organizations (ACOs) or similar CMS-regulated organizations (including CMS-regulated Qualified Entities).
• On January 20, 2017, the President's Assistant and Chief of Staff issued a memorandum to the heads of executive departments and agencies, freezing implementation of new regulations for 60 days. As such, the Final Rule's effective date of February 17, 2017 is postponed in accordance with the executive memorandum.

Supplemental Notice of Proposed Rulemaking

SAMHSA received numerous comments in response to the Proposed Rule including comments and questions that went beyond the parameters of the proposed changes. As a result, in conjunction with the issuance of the Final Rule, SAMHSA issued a supplemental notice of proposed rulemaking to request comments on issues that were not addressed in the Final Rule or for which it believes further consideration is warranted. Specifically, SAMHSA proposes provisions related to the following:

Disclosure for Payment and Health Care Operations

SAMHSA seeks comment on proposed provisions that would clarify the circumstances under which disclosures to contractors, subcontractors and legal representatives of lawful holders of Part 2 information may receive and use Part 2 information for purposes of carrying out payment and health care operations activities. Currently, a recipient of Part 2 information cannot disclose the information to its subcontractors without patient consent that specifically identifies the subcontractor. SAMHSA proposes an exclusive list of the specific types of payment and health care operations activities for which a lawful holder of Part 2 patient information would be allowed to disclose the information without patient consent. Those activities include:

• Billing, claims management, collections activities, obtaining payment under a contract for reinsurance, claims filing and related health care data process
• Clinical professional support services (e.g., quality assessment and improvement; initiatives, utilization review and management services)
• Patient safety activities
• Activities pertaining to training of student trainees and health care professionals, assessment of practitioner competencies, assessment of provider or health plan performance, and training of non-health care professionals
• Accreditation, certification, licensing or credentialing activities
• Underwriting, enrollment, premium rating and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing or placing a contract for reinsurance of risk relating to claims for health care
• Third-party liability coverage
• Activities related to addressing fraud, waste and abuse
• Conducting or arranging for medical review, legal services and auditing functions
• Business planning and development, such as conducting cost management and planning-related analyses related to managing and operating, including formulary development and administration, development or improvement of methods of payment or coverage policies
• Business management and general administrative activities, including, but not limited to, management activities relating to implementation of and compliance with the requirements of this or other statutes or regulations
• Customer services, including the provision of data analyses for policyholders, plan sponsors or other customers
• Resolution of internal grievances
• The sale, transfer, merger, consolidation or dissolution of an organization
• Determinations of eligibility or coverage (e.g. coordination of benefit services or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims
• Risk adjusting amounts due based on enrollee health status and demographic characteristics
• Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care or justification of charges

SAMHSA notes that this list is similar to the HIPAA Privacy Rule's definition of the terms "payment" and "health care operations," but stated that it is not adopting the HIPAA definitions in their entirety. SAMHSA excluded payment and health care activities it considers to be related to the patient's diagnosis, treatment or referral for treatment such as care coordination and case management. The rationale for this limitation is to maintain patient choice in disclosing information to health care providers with whom they will have direct contact.

Under the proposed changes, contractors, subcontractors and legal representatives that receive data would become lawful holders upon receipt of the data and, therefore, would be subject to Part 2. Further disclosures still would require consent. Additionally, lawful holders of Part 2 information that engage contractors or subcontractors to carry out payment and health care operations must include specific contractual provisions requiring those entities to comply with provisions of Part 2. SAMHSA also stated that lawful holders and Part 2 programs have responsibility to exercise due diligence with respect to their contractors, subcontractors, or legal representatives to whom they disclose or with whom they exchange information.

SAMHSA notes that the fact that lawful holders and Part 2 programs are permitted to disclose data does not obviate the overarching purpose of Part 2, which is to protect information for patients seeking diagnosis, treatment or referral for treatment for substance use disorders.

Audit and Evaluation

The Final Rule permits disclosure of Part 2 information to accountable care organizations and similar CMS-regulated entities to carry out Medicaid and Medicare audits and evaluations. In the supplemental proposed notice of rulemaking, SAMHSA suggests a provision to clarify that certain contractors, subcontractors and legal representatives may carry out audit and evaluation activities on behalf of certain CMS-regulated entities.

Statement Prohibiting Re-Disclosure

Currently, any disclosure of information governed by Part 2 that is made with the patient's written consent must be accompanied by a notice prohibiting further disclosure. The Regulations specify the content of the notice:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

SAMHSA does not propose to substantively modify the existing notice, but seeks comment on whether it should add a shorter abbreviated statement to be used in certain circumstances where a shorter notice may be warranted. SAMHSA suggested the following in the proposed notice of additional rulemaking: "Data is subject to 42 CFR part 2. Use/disclose in conformance with part 2."

Requests for Public Comments

SAMHSA has indicated that it seeks comment on the implications of these proposed changes on the privacy and confidentiality of Part 2 records. Additionally, it seeks comment on the following for its consideration in future rulemaking and guidance:

• Additional purposes for which lawful holders should be able to disclose (Part 2) patient identifying information
• Further subregulatory guidance that SAMHSA and other agencies could provide to help facilitate implementation of 42 C.F.R. Part 2 in the current health care environment

Comments on the proposed rulemaking must be submitted by February 17, 2017.