Federal Privacy Rules Require Amendment to Benefit Plan Service Agreements

Legal Alert

December 10, 2019

ERISA-Medicare-Health-Records-Alert-template

The Confidentiality of Substance Use Disorder Patient Records regulations (commonly referred to as “Part 2”), a federal privacy law aimed at protecting patient records related to substance abuse treatment, will require employers to amend several of their group health plan service agreements no later than February 2, 2020.

Background. Part 2 provides special privacy protections, over and above those provided by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), to patient records related to substance abuse treatment that are created by federally funded treatment programs (e.g., programs that accept Medicare or Medicaid) (“Part 2 Programs”). Under these rules, a Part 2 Program may only release patient records protected by Part 2 with the patient’s written consent, pursuant to a court order, or under a few other limited exceptions.

Application to Employer-Sponsored Group Health Plans. An employer-sponsored group health plan that receives patient records from Part 2 Programs in processing benefit claims must comply with Part 2, in addition to its HIPAA obligations, with respect to those records. Part 2 allows group health plans to receive patient records from Part 2 Programs to pay benefit claims if the patient specifically consents to the disclosure, but imposes strict requirements on the plan’s ability to re-disclose those records.

Part 2 Contract Requirements. New rules under Part 2 require group health plans that contract with third-party service providers to carry out the plan’s payment activities and health care operations to include specific language explicitly addressing Part 2 compliance in their service agreements. Notably, general language regarding compliance with “applicable federal laws” that may already be included in these agreements is not considered sufficient to satisfy the new contract requirements under Part 2.

Covered Service Agreements. The Part 2 contract requirements apply only to plan service providers that receive patient records related to substance abuse treatment from Part 2 Programs. This may include, for example, third-party claims administrators for the plan’s medical and prescription drug benefit programs, and consultants or actuaries who receive medical or prescription drug claims information. Plan sponsors have until February 2, 2020, to bring their covered service agreements into compliance.

Next Steps. For additional information, please contact your Employee Benefits and Executive Compensation Counsel at Smith, Gambrell & Russell, LLP. Our team has developed form contract language to meet the new Part 2 requirements and would be glad to assist with identifying the service agreements that will need to be amended under the new rules. We can also assist with negotiating contract language with these service providers (who also have obligations under Part 2).