Health Law Blog - Healthcare Legal Issues

Posts Tagged ‘SAMHSA Records’

Written Agreement Requirement for Disclosure of Part 2 Records

Wednesday, January 31st, 2018

Disclosure of Part 2 Records for Payment or Health Care Operations Requires Written Agreement

Regulations issued by SAMHSA in January of 2018, permit a lawful holder of Part 2 Records (relating to alcohol or substance abuse treatment) to disclose those records, with written consent of the patient, to its contractors, subcontractors, or legal representatives to carry out payment or healthcare operations on behalf of the lawful holder. The regulations list 17 examples of situations where a release may be considered appropriate. Disclosures to contractors, subcontractors, and legal representatives to carry out other purposes such as substance use disorder patient diagnosis, treatment, or referral for treatment are not permitted under the new rule.

In order to take advantage of the rule permitting disclosure for payment and/or health care operations, the lawful holder of the information is required to have in place a written contract or comparable legal instrument with the contractor or voluntary legal representative, which provides that the contractor, subcontractor, or voluntary legal representative is fully bound by the provisions of part 2 upon receipt of the patient identifying information.

In addition to having a proper contract in place, when making any such disclosures, the lawful holder must take the following further steps:

  • furnish such recipients with the notice required under § 2.32 of the regulations;
  • require such recipients to implement appropriate safeguards to prevent unauthorized uses and disclosures; and
  • require such recipients to report any unauthorized uses, disclosures, or breaches of patient identifying information to the lawful holder.

The lawful holder may only disclose information to the contractor or subcontractor or voluntary legal representative that is necessary for the contractor or subcontractor or voluntary legal representative to perform its duties under the contract or comparable legal instrument. Contracts may not permit a contractor or subcontractor or voluntary legal representative to re-disclose information to a third party unless that third party is a contract agent of the contractor or subcontractor, helping them provide services described in the contract, and only as long as the agent only further discloses the information back to the contractor or lawful holder from which the information originated.

17 Examples SAMHSA Payment and Health Care Operations

Wednesday, January 31st, 2018

Examples of Disclosures of Part 2 Records for Payment and Health Care Operations

In regulations released in January of 2018, SAMHSA included a list of 17 specific types of payment and health care operations in the regulatory text that would be the basis for further disclosures by a lawful holder of patient identifying information. SAMHSA did not include this list of 17 items in the regulations.  Rather, these items were contained in the preamble reflecting that additional reasons for release for payment and health care operations may be permissible.  Examples of permissible activities under § 2.33(b) that SAMHSA considers to be payment and health care operations activities include:

  • Billing, claims management, collections activities, obtaining payment under a contract for reinsurance, claims filing and related health care data processing;
  • Clinical professional support services (e.g., quality assessment and improvement initiatives; utilization review and management services);
  • Patient safety activities;
  • Activities pertaining to:
  • The training of student trainees and health care professionals;
  • The assessment of practitioner competencies;
  • The assessment of provider and/or health plan performance; and
  • Training of non-health care professionals;
  • Accreditation, certification, licensing, or credentialing activities;
  • Underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care;
  • Third-party liability coverage;
  • Activities related to addressing fraud, waste and abuse;
  • Conducting or arranging for medical review, legal services, and auditing functions;
  • Business planning and development, such as conducting cost management and planning-related analyses related to managing and
    operating, including formulary development and administration, development or improvement of methods of payment or coverage
  • Business management and general administrative activities, including management activities relating to implementation of and compliance with the requirements of this or other statutes or regulations;
  • Customer services, including the provision of data analyses for policy holders, plan sponsors, or other customers;
  • Resolution of internal grievances;
  • The sale, transfer, merger, consolidation, or dissolution of an organization;
  • Determinations of eligibility or coverage (e.g. coordination of benefit services or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims;
  • Risk adjusting amounts due based on enrollee health status and demographic characteristics;
  • Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges.

SAMHSA believes it is important to maintain patient choice in disclosing information to health care providers with whom patients have direct contact. For this reason, the final provision in § 2.33(b) does not cover care coordination or case management and disclosures to contractors, subcontractors, and legal representatives to carry out such purposes are not permitted under this section. In addition, SAMHSA added language to the regulatory text in § 2.33(b) to clarify that disclosures to contractors, subcontractors and legal representatives are not permitted for activities related to a patient’s diagnosis, treatment, or referral for treatment.

Notice of Restriction on Re-Disclosure SAMHSA Records

Wednesday, January 31st, 2018

Prohibition on Re-Disclosure – Changes in New SAMHSA Final Rules (§ 2.32)

Redisclosure Notice SAMHSA RecordsOne of the primary new operative provisions that was created in the 2017 Final Rules is an expanded prohibition against re-disclosure of records that are covered under SAMHSA. Even when a disclosure is permitted, the 2017 rules required the disclosure to be accompanied by a lengthy written statement, notifying the recipient of the special status of the information and the prohibition against re-disclosure. The notification was rediculously long:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

The new 2018 Rules create an abbreviated notice that is 80 characters long to fit in standard free-text space within health care electronic systems. The abbreviated notice in this final rule reads ‘‘Federal law/42 CFR part 2 prohibits unauthorized disclosure of these records.’’

The 42 CFR part 2 regulations have always required that a notice of the prohibition on redisclosure accompany each disclosure made with the patient’s written consent. With the adoption of electronic health record systems, it became difficult to comply electronically with the longer notification form due to character limits in freetext fields within electronic health record systems. Many electronic record systems contain a free text space with a maximum character capacity of 80 characters. The new 2018 Rules reflect SANHSA’s belief that offering an abbreviated notice option will be beneficial to providers who use electronic health record systems to exchange data.

SAMHSA recognizes concerns that an abbreviated notice could be insufficient to convey understanding of part 2 requirements. SAMHSA encourages part 2 programs and other lawful holders of restricted records that chose to use the abbreviated notice to discuss the restriction and redisclosure requirements applicable to SAMHSA protected records with those to whom they disclose patient identifying information.

First Article in SAMHSA Series

John H. Fisher

Health Care Counsel
Ruder Ware, L.L.S.C.
500 First Street, Suite 8000
P.O. Box 8050
Wausau, WI 54402-8050

Tel 715.845.4336
Fax 715.845.2718

Ruder Ware is a member of Meritas Law Firms Worldwide

The Health Care Law Blog is made available by Ruder Ware for educational purposes and to provide a general understanding of some of the legal issues relating to the health care industry. This site does not provide specific legal advice and you should not use the information contained on this site to address your specific situation without consulting with legal counsel that is well versed in health care law and regulation. By using the Health Care Law Blog site you understand that there is no attorney client relationship between you and Ruder Ware or any individual attorney. Postings on this site do not represent the views of our clients. This site links to other information resources on the Internet; these sites are not endorsed or supported by Ruder Ware, and Ruder Ware does not vouch for the accuracy or reliability of any information provided therein. For further information regarding the articles on this blog, contact Ruder Ware through our primary website.