Updates to Group Health Plan Service Agreements May be Required to Comply with Final Rule Regarding Confidentiality of Substance Use Disorder Patient Records

Patient substance use disorder (SUD) records received by group health plans from federally funded treatment programs are subject to the restrictions of 42 CFR Part 2 (Part 2). The federal Substance Abuse and Mental Health Services Administration (SAMHSA) issued final regulations on January 3, 2018, updating the provisions of Part 2 related to the confidentiality of SUD records. The disclosure restrictions of the final rule are applicable to group health plans (and other third-party payers) and plan service providers that receive SUD patient-identifying records directly from a Part 2 provider or from a group health plan to perform their services.

When a patient consents to the release of their SUD records for payment or health care operations, a “lawful holder” such as a group health plan may re-disclose the information to a third-party vendor providing services to the plan only “as may be necessary” to carry out the payment or health care operations of the plan. In such cases, the group health plan’s service provider is wholly subject to the restrictions of Part 2 upon receipt and may not re-disclose the SUD records.

In addition, the final rule requires that the written agreement between the group health plan and the service provider must conform to the following requirements:

1. Contain a statement that “42 CFR part 2 prohibits unauthorized disclosure of these records”;
2. Require the plan service provider to implement appropriate safeguards to prevent unauthorized uses and disclosures; and
3. Obligate the plan service provider to report to the group health plan any unauthorized use, disclosure or breach of patient SUD records.

Those group health plans currently sharing SUD records with plan service providers for claims administration or other purposes are past the deadline – February 2, 2020 – for bringing their service agreements into compliance. Where Part 2 is applicable to a group health plan, amending existing business associate agreements with third-party vendors to include the required Part 2 provisions may be the most straightforward method for satisfying the Part 2 mandate. Plan sponsors of group health plans potentially receiving SUD records subject to Part 2 should work with legal counsel to thoroughly review their agreements to ensure compliance.

Federal Register, Vol. 83, No. 2, Wednesday, January 3, 2018, Final Rule: 42 CFR Part 2, “Confidentiality of Substance Use Disorder Patient Records.”