Introduction

In our ongoing engagement with behavioral health and substance abuse programs, we maintain a vigilant focus on matters relating to patient record confidentiality governed by 42 CFR Part 2, commonly known as the SAMHSA regulations. Notable updates occurred in 2017 and 2018, resulting in significant modifications to protocols for sharing and safeguarding sensitive information.

Key Changes in Confidentiality Provisions

One pivotal outcome of these regulatory amendments is the extension of rigorous confidentiality standards to individuals who obtain patient information from Part 2 programs. This development has notable implications for the exchange of information between Part 2 entities and providers operating outside their purview, particularly when addressing cases involving dual diagnoses of substance use and mental health disorders. However, an unintended effect has emerged: external providers now hesitate to reference Part 2 program treatment in their documentation, fearing that such inclusion could subject their entire record to Part 2’s stringent requirements.

August 2019 Proposed Regulatory Revisions

In late August 2019, SAMHSA issued further proposed revisions to its regulations. These proposals directly tackle the challenges associated with communication between Part 2 program providers and those treating patients outside such programs. The intent is to clarify current obligations and introduce new guidelines intended to mitigate inadvertent barriers to effective collaboration among behavioral health professionals.

Patient Consent Requirements

Unlike HIPAA provisions, dissemination of information pertaining to Part 2 treatment to external providers necessitates patient consent aligned with the detailed criteria outlined in Part 2. This mandate applies even in integrated provider settings. For example, certain mental health facilities offer comprehensive behavioral health services alongside a Part 2 substance and alcohol recovery program. Within these institutions, multidisciplinary teams routinely discuss care plans for individuals with dual diagnoses. Nevertheless, all exchanges involving Part 2 protected information, including intra-organizational communications, must be supported by written patient consent.

Communication and Documentation Practices

A substantial portion of interactions between Part 2 and non-Part 2 providers transpire through oral consultations, which non-Part 2 providers frequently record in behavioral health documentation.  Subsequent to the regulatory changes in 2017 and 2018, concerns arose among non-Part 2 providers that any mention of Part 2 participation within these records would result in their entirety being subject to Part 2 restrictions. This apprehension has led to diminished inter-provider communication and collaboration, even in circumstances where patient consent had been appropriately obtained.

Proposed Solutions in New Regulations

The newly introduced regulations aim to resolve this issue by permitting non-Part 2 providers to incorporate references from oral discussions with Part 2 programs into the patient’s behavioral health record without subjecting the full record to Part 2 governance. Such communications remain contingent upon valid patient consent authorizing exchanges between the respective parties.

Segregation of Formal Part 2 Records

Crucially, the proposed regulations do not allow unrestricted sharing of official Part 2 materials with external providers. When an outside provider receives formal Part 2 documentation, those records must be maintained separately from general behavioral health files. Failure to properly segment these materials results in the entire record falling under Part 2’s strict parameters, thereby complicating access controls and increasing compliance risk for providers not requiring access to protected information.

Summary of Regulatory Impact

Ultimately, the newly proposed regulations exclude limited oral exchanges between Part 2 and external providers recorded in non-Part 2 documentation from classification as Part 2 records. Many providers interacting with Part 2 programs about shared patients may not be fully cognizant of these regulatory subtleties, given the recency and limited dissemination of these changes beyond specialized circles. It is prudent for providers to review and update policies and procedures to reflect the requirements introduced in 2017 and 2018. While implementation of the proposed regulations remains uncertain, it is essential to maintain stringent protocols for record segmentation to safeguard compliance and mitigate risks for providers serving Part 2 patients outside designated programs.