Updates to Group Health Plan Service Agreements May be Required to Comply with Final Rule Regarding Confidentiality of Substance Use Disorder Patient Records

Hodgson Russ LLP

Patient substance use disorder (SUD) records received by group health plans from federally funded treatment programs are subject to the restrictions of 42 CFR Part 2 (Part 2). The federal Substance Abuse and Mental Health Services Administration (SAMHSA) issued final regulations on January 3, 2018, updating the provisions of Part 2 related to the confidentiality of SUD records. The disclosure restrictions of the final rule are applicable to group health plans (and other third-party payers) and plan service providers that receive SUD patient-identifying records directly from a Part 2 provider or from a group health plan to perform their services.

When a patient consents to the release of their SUD records for payment or health care operations, a “lawful holder” such as a group health plan may re-disclose the information to a third-party vendor providing services to the plan only “as may be necessary” to carry out the payment or health care operations of the plan. In such cases, the group health plan’s service provider is wholly subject to the restrictions of Part 2 upon receipt and may not re-disclose the SUD records.

In addition, the final rule requires that the written agreement between the group health plan and the service provider must conform to the following requirements:

  1. Contain a statement that “42 CFR part 2 prohibits unauthorized disclosure of these records”;
  2. Require the plan service provider to implement appropriate safeguards to prevent unauthorized uses and disclosures; and
  3. Obligate the plan service provider to report to the group health plan any unauthorized use, disclosure or breach of patient SUD records.

Those group health plans currently sharing SUD records with plan service providers for claims administration or other purposes are past the deadline – February 2, 2020 – for bringing their service agreements into compliance. Where Part 2 is applicable to a group health plan, amending existing business associate agreements with third-party vendors to include the required Part 2 provisions may be the most straightforward method for satisfying the Part 2 mandate. Plan sponsors of group health plans potentially receiving SUD records subject to Part 2 should work with legal counsel to thoroughly review their agreements to ensure compliance.

Federal Register, Vol. 83, No. 2, Wednesday, January 3, 2018, Final Rule: 42 CFR Part 2, “Confidentiality of Substance Use Disorder Patient Records.”

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Hodgson Russ LLP | Attorney Advertising

Written by:

Hodgson Russ LLP

Hodgson Russ LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.