◆ HHS changed its tone on care coordination and case management in the final Confidentiality of Substance Use Disorder Patient Records regulation (42 C.F.R. § 2), known as Part 2.^[1] In the regulation, which was published in the Federal Register on July 15,^[2] care coordination and case management were added to a list of 17 activities, including billing and fraud, waste and abuse activities, that now will be treated as payment and health care operations. When combined with other provisions, this means a patient can consent to share substance use disorder information with a Part 2 entity, and that entity can further disclose the information to its contractors for payment and health care operations. The reversal from HHS will be welcomed by Part 2 providers, said Los Angeles attorney Adam Hepworth, with Foley & Lardner. “Before, it would have been hard to get substance use disorder information from a Part 2 entity to a care coordination entity because there wasn’t really a direct pathway for an individual to consent to it, but in the final rule, there is more than one way,” Hepworth said. “This is a simple and straightforward way.” The Part 2 rule applies to organizations that provide drug and alcohol diagnosis and treatment and receive federal assistance, potentially including providers participating in Medicare and/or Medicaid. HHS’s Substance Abuse and Mental Health Services Administration (SAMHSA) enforces the rule, which dates back to 1975. Part 2 was revised in 2017 and 2018, when regulators modernized it and pushed it somewhat closer to HIPAA in light of the opioid crisis. In the new final rule, SAMHSA also worked to better align Part 2 with HIPAA. Physicians and other clinicians now will have slightly more freedom to share substance use treatment information with non-Part 2 providers. Under the rule, if the substance use disorder patient records from Part 2 providers are “segregated” in the medical records, then providers who do not fall under Part 2 will not be required to apply stringent Part 2 requirements to other parts of the medical records. Instead, providers can use the information as long as they comply with HIPAA. Also, SAMHSA modified the written consent requirements so that patients aren’t required to specify the individual to whom a disclosure will be made; instead, the name of the entity is good enough. “If you want to link someone up with social services or food safety, there was no way to operationalize that,” Hepworth noted. “That was a huge barrier. SAMHSA is incrementally easing the barrier, because in today’s times, people are trying to follow a model of whole-person care and address the social determinants of health.” The final rule goes into effect Aug. 14.