HHS Office for Civil Rights Clarifies Privacy Rules for State Medicaid Programs

Guidance Outlines When 42 CFR Part 2 Permits Using Substance Use Disorder Patient Records to Verify Community Engagement Exclusions

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) today issued guidance clarifying when the regulation on Confidentiality of Substance Use Disorder (SUD) Patient Records under 42 CFR part 2 (“Part 2”) permits a state Medicaid agency to use a Medicaid applicant’s or beneficiary’s SUD patient records protected under Part 2 to verify an exclusion from the community engagement requirement for Medicaid eligibility.

“This OCR guidance will help state Medicaid agencies use information they already have to identify individuals who are excluded from the community engagement requirement, while continuing to protect the confidentiality of SUD patient records as required by Part 2,” said OCR Director Paula M. Stannard. “This new guidance helps ensure that state Medicaid agencies comply with Part 2 while also meeting their obligations to verify Medicaid eligibility — and without imposing unnecessary documentation burdens on eligible applicants and beneficiaries.”

OCR administers and enforces Part 2, which protects the privacy of certain SUD patient records (“Part 2 records”) and describes when and how Part 2 records may be used and disclosed. Part 2 requirements generally apply to any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment (“Part 2 programs”). Some Part 2 requirements also apply to people and organizations who receive Part 2 records from a Part 2 program, such as health plans that pay for SUD treatment and government health benefits programs such as Medicaid.

The federal community engagement requirement generally requires certain adults (ages 19–64) who are Medicaid applicants or beneficiaries to engage in work, community service, or certain other activities for 80 hours per month, or be enrolled at least half-time in education, to be eligible for Medicaid. However, certain categories of individuals are excluded from the community engagement requirement, such as individuals who are medically frail or otherwise have special medical needs (including certain individuals with SUD) and individuals who are participating in certain SUD treatment programs. Federal law also requires a state to use reliable information it has available to verify the applicant’s or beneficiary’s compliance or exclusion without requiring the individual to submit additional information, where possible.

The new guidance is available at: https://www.hhs.gov/sites/default/files/ocr-faq-part-2-sud.pdf.

If you believe that your or another person’s health information privacy, civil rights, or conscience rights have been violated, you can file a complaint with OCR at https://www.hhs.gov/ocr/complaints/index.html.

Follow HHS OCR on X at @HHSOCR.