By Fisher, JD, CHC, CCEP

2018 SAMHSA Final Rule: Clarifying Part 2 Confidentiality Requirements

On January 3, 2018, the Substance Abuse and Mental Health Services Administration (SAMHSA) published final regulations updating 42 CFR Part 2, the federal confidentiality rules governing certain substance use disorder patient records. These 2018 regulations supplemented the major Part 2 revisions finalized in January 2017 and were intended to provide additional clarification and specificity for implementation.

Overview of Part 2

Part 2 applies special confidentiality protections to substance use disorder patient records maintained by federally assisted programs. These protections are generally more restrictive than the rules that apply to ordinary health records because disclosure of substance use disorder information can expose patients to stigma, discrimination, or legal and personal consequences.

Why SAMHSA Updated the Rules

SAMHSA began modernizing Part 2 in 2016 to account for changes in the health care system, including integrated care models and the electronic exchange of patient information. The 2017 final rule made broad updates to Part 2, while the 2018 final rule addressed additional issues that remained important for day-to-day compliance.

Key Clarifications in the 2018 Final Rule

The 2018 rule clarified how lawful holders of Part 2 information, along with their legal representatives, contractors, and subcontractors, may use or disclose patient-identifying information for payment, health care operations, audits, and evaluations. It also provided an option for an abbreviated prohibition-on-redisclosure notice and made technical corrections for clarity.

Permissible Payment and Health Care Operations Activities

Under § 2.33(b), SAMHSA identified examples of payment and health care operations activities that may support further disclosures by a lawful holder of patient-identifying information, when the disclosure is otherwise permitted and consistent with the patient’s consent.

• Billing, claims management, collections, and related health care data processing.
• Quality assessment, utilization review, patient safety activities, and care coordination.
• Case management, protocol development, and population-based activities to improve health or reduce health care costs.
• Training programs for students, trainees, health care professionals, and other workforce members.
• Accreditation, certification, licensing, credentialing, and review of provider qualifications.
• Medical review, legal services, auditing functions, and compliance activities.
• Business planning, business management, customer service, and administrative operations.
• Activities related to health insurance or benefits, including underwriting, enrollment, premium rating, eligibility determinations, coverage decisions, and claims adjudication.
• Third-party liability determinations and activities related to the sale, transfer, merger, consolidation, or dissolution of an organization.

Importance of the Permissible Activities

These permissible activities are important because they help lawful holders understand how Part 2 information may be used to support essential health care functions after valid written consent has been obtained. Without this clarification, organizations could face uncertainty about whether routine operational activities—such as billing, quality review, care coordination, auditing, or credentialing—fall within the scope of permitted uses and disclosures.

The examples also promote consistency. They give providers, payers, contractors, and other lawful holders a clearer framework for evaluating whether a proposed disclosure is tied to payment or health care operations and whether it remains consistent with the patient’s consent and Part 2’s confidentiality requirements.

Balancing Privacy and Health Care Operations

The 2018 final rule does not create unrestricted access to substance use disorder records. Instead, it attempts to balance two goals: protecting sensitive patient information and allowing the health care system to perform necessary administrative and operational functions. This balance is central to Part 2 because confidentiality protections encourage patients to seek treatment while still permitting information to be used appropriately in modern health care delivery.