To: Hospital and health system legal counsel and government affairs staff
From: Jaclyn Greenberg, Policy Director, Legal Affairs | Jaclyng@wsha.org (206) 216-2506
Subject: Disclosure of Substance Use Disorder records during COVID-19
Purpose
The purpose of this bulletin is to clarify the legal requirements for the use and disclosure of Substance Use Disorder (SUD) records during the COVID-19 emergency.
The confidentiality of SUD records is governed by a strict federal law, 42 C.F.R. 2 (“Part 2”). Written consent to use or disclose these records is generally required. Unlike the privacy rule under the Health Insurance Portability and Accountability Act (HIPAA), there are no exceptions for purposes of treatment, payment or operations.
In response to the COVID-19 emergency and the fact that many SUD treatment provider offices are closed and people may not be able to present for treatment services in person, the Substance Abuse and Mental Health Services Administration (SAMHSA) released guidance to help address possible interruptions in service. The SAMHSA Guidance on Part 2 during COVID-19 essentially reminds SUD providers that:
- Patient identifying information may be disclosed by a Part 2 program or other lawful holder to medical personnel, without patient consent, to the extent necessary to meet a bona fide medical emergency in which the patient’s prior informed consent cannot be obtained;
- Information disclosed to the medical personnel who are treating such a medical emergency may be re-disclosed by such personnel for treatment purposes as needed;
- Reliance on the emergency condition exception must be documented; and,
- The determination of whether there is an emergency medical condition is up to the individual provider.
The medical emergency exception applies only in the case of a specific individual patient with a medical emergency, and not to a public health emergency generally. SAMHSA’s guidance is limited to highlighting the existing exception to the written consent requirement. It is not a waiver of Part 2 rules. The current state of emergency is not a basis for disclosing records without following Part 2’s written consent requirements.
Applicability/Scope
The federal law governing the confidentiality of SUD records, 42 C.F.R. 2, applies to all hospitals that provide SUD diagnoses, treatment or referral for treatment, including co-occurring disorders.
Recommendation
- Review this bulletin and SAMHSA guidance about Part 2 rules during COVID-19.
- Review the Part 2 consent requirements.
- Review the Part 2 medical emergencies exception.
- If you have not already done so, consider establishing a policy for utilizing the medical emergency exception, including specifying documentation requirements for when the exception is relied upon in an individual case.
Overview and Background
The federal law governing the disclosure of SUD records, 42 U.S.C. § 290dd–2 and its regulations at 42 C.F.R. 2 (collectively “Part 2”), is one of the strictest privacy laws in the country. Unlike the HIPAA Privacy Rule, which allows for disclosures of PHI without written authorization in a wide variety of circumstances, namely for treatment, payment and operations, Part 2 requires written consent for nearly all types of disclosures of information.
The current consent requirements effectively require a fresh written consent for each individual use/disclosure.
Part 2’s written consent requirements are detailed and should be reviewed carefully. They include:
- Consent must be written, but may be paper or electronic, and must include:
- The name of the patient and who may make the disclosure;
- How much and what kind of information is to be disclosed, including an explicit description of the SUD information that may be disclosed;
- To whom the information is to be disclosed, with specific requirements for individuals, entities with a treating provider relationship with the patient (e.g. hospital), and entities without a treating provider relationship with the patient;
- The purpose of the disclosure. Note: the disclosure must be limited to only the information necessary to carry out the stated purpose;
- A statement that the consent is subject to revocation at any time except to the extent that the disclosing party already acted in reliance on the consent;
- The date, event, or condition upon which the consent will expire if not revoked before. Note: this date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is provided;
- The patient or their representative’s signature when authorized under Part 2. Note: electronic signatures are permitted, subject to other applicable law; and,
- The date on which the consent is signed.
The medical emergency exception. There are limited exceptions to this consent requirement. One of them is if there is a bona fide emergency medical condition. Under 42 U.S.C. §290dd-2(b)(2)(A) and 42 C.F.R. §2.51, patient identifying information may be disclosed by a part 2 program or other lawful holder to medical personnel, without patient consent, to the extent necessary to meet a bona fide medical emergency in which the patient’s prior informed consent cannot be obtained. Information disclosed to the medical personnel who are treating such a medical emergency may be re-disclosed by such personnel for treatment purposes as needed. Reliance on the medical emergency exception must be documented.
According to the SAMHSA guidance on Part 2 disclosures during COVID-19, the prohibitions on use and disclosure of patient identifying information would not apply in situations where providers may not be able to obtain written patient consent – for instance, due to office closures or the provision of telehealth services, “to the extent that, as determined by the provider(s), a medical emergency exists.” (emphasis added).
A bona fide medical emergency is not defined but it is specific to the individual patient and not a blanket emergency, such as the current public health emergency. For instance, a hospital treating a COVID-19 patient that believes past SUD treatment may be relevant to emergency care for that COVID-19 patient may access SUD information under this exception. This is consistent with guidance from SAMHSA through its FAQs and proposed rulemaking to broaden the medical emergency exception to address the impact of major and natural disasters.
Changes to Part 2 under the CARES Act. Under Section 3221 of the CARES Act, the third federal stimulus bill to address the current emergency, there are several significant changes to Part 2, including the long sought-after objective of better alignment with HIPAA. Among the key provisions, Section 3221 modifies the written consent requirements to contemplate that once written consent is obtained, the SUD records may be used/disclosed by any covered entity, business associate or SUD program for purposes of treatment, payment or operations under HIPAA. Other changes include bolstering enforcement provisions, updating notice of privacy practices, and establishing an anti-discrimination provision.
Unfortunately, the effective date for those changes is March 27, 2021. The law changes do not apply before then and there is much rulemaking activity required to implement them.
Until such time as new rules are adopted, providers must continue to evaluate whether a bona fide medical emergency exists for individual patients before disclosing SUD records without the required written consent.
Background and References
42 CFR §2.31 – Consent Requirements
42 CFR § 2.51 – Medical emergencies
SAMHSA COVID-19 Public Health Emergency Response and 42 CFR 2 Guidance
SAMHSA FAQs – See FAQs 5, 8 and 9
SAMHSA Notice of Proposed Rulemaking – August 26, 2019
Manatt analysis – The CARES Act Brings Key Changes to the SUD Confidentiality Statute
