Skip to Main Content

HHS Published a Revised Confidentiality of SUD Patient Records Final Rule

HHS published a revised Confidentiality of SUD Patient Records final rule. The final rule outlines confidentiality protections for patient records created by federally assisted substance use disorder treatment programs (SUD records). The CARES Act contained modifications to the SUD confidentiality laws that expanded the circumstances under which SUD records may be used and disclosed in accordance with the HIPAA rules regarding treatment, payment, and health care operations. HHS noted in the revised final rule that several of the provisions in the revised final rule will serve as interim transitional standards until regulations confirming to the CARES Act are released.

Under the final rules, if a patient consents to the disclosure of SUD records for payment or health care operations, the recipient, such as a group health plan, may further disclose the information for payment or health care operations (which include care coordination and case management) to its contractors, subcontracts, and legal representatives without additional consent. The revised final rules contain a list of examples of activities that HHS considers to be payment and health care operation activities. The disclosure must be limited to the information necessary to carry out the purpose of the disclosure.

The revised final rules also provide that health plans may obtain SUD information without patient consent to periodically conduct audits or evaluations for purposes such as identifying agency or health plan actions or policy changes aimed at improving care and outcomes for patients (for example, provider education, recommending or requiring improved health care approaches); targeting limited resources more effectively to better care for patients; adjusting specific insurance components to facilitate adequate coverage and payment; and reviews of appropriateness of medical care, medical necessity, and utilization of services.

Read more about the SUD confidentiality provisions under the CARES Act.