Whether you work in healthcare or are a patient in the community at large, almost everyone who has received medical care has heard of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), one of the first comprehensive pieces of federal legislation to address the use and disclose of protected health information held by medical providers, health plans, and other “covered entities.” Far fewer are familiar with the more restrictive federal and Florida laws that provide privacy protection to alcohol and drug abuse patients. The technical details of these regulations are not only important for providers and patients, but for private equity and other investors looking to purchase such businesses and reap the benefits of a lucrative business model.

Over the past few months there have been scores of articles written about the Substance Abuse and Mental Health Services Administration (“SAMHSA”) proposed rules to modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 C.F.R. Part 2 (commonly refered to as “Part 2”), which govern the disclosure of confidential patient information for federally assisted drug and alcohol treatment programs. For-profit programs and private practitioners who use a controlled substance for detoxification or maintenance treatment of a substance use disorder are also subject to these regulations because such use requires a federal Drug Enforcement Administration (“DEA”) registration and subjects the program and private practitioner to DEA regulations as a condition of DEA licensure. Part 2 was enacted, in part, as some patients avoid treatment for fear that public disclosure of their treatment will foster stigma and discrimination toward them. Part 2 provides substance abuse treatment patients with privacy protection by only allowing the disclosure of their treatment records, under limited circumstances, without their written consent. The Florida equivalent of Part 2 is Section 397.501, Florida Statutes, which in certain instances, is even more restrictive than Part 2. While the privacy and disclosure regulations are paramount to patients feeling secure in seeking treatment, they are an enormous obstacle for mergers and acquisitions involving substance abuse treatment businesses.

The heightened interest in the substance abuse market by investors came shortly after laws were passed giving treatment for mental health disorders payment parity with physical disorders. Since potential investors may not necessarily be experts in the mental health industry, and some sellers may not be sophisticated health care systems, they are unaware of the laws that limit the disclosure of such substance abuse information. As a result of the restrictive nature of these laws, investors will not be able to freely conduct due diligence.

Many substance abuse providers are under the mistaken assumption that if they satisfy the requirements of HIPAA that they can disclose protected health information concerning a patient receiving treatment for a substance abuse disorder. However, the parameters under which patient treatment information can be disclosed under Part 2 and Section 397.501, Florida Statutes are far more restrictive.

De-identifying patient information is one way to avoid these restrictions, but many treatment providers do not de-identify their patient data in the billing and collection process. De-identifying such information during the sale process can not only be costly and cause delays, but there are also restrictions on the seller being able to retain a third party to de-identify such information. Therefore, a buyer will not be able to conduct a comprehensive financial due diligence and prepare its own audited financials because it will not be able to review all of the billing and collection records without potentially violating federal and Florida law. Instead, it will have to rely on financial data prepared by a business associate of the seller, who will have to perform its analysis onsite. De-identified patient records are not to be removed from the facility, copied or downloaded.

It is positive news that on February 9, 2016, the U.S. Department of Health and Human Services issued proposed rules that are aimed at modifying Part 2 with respect to sharing patient information to align with advances in the national health care delivery system. It is a sign that the government understands that laws need to adapt to changes in technology and health care delivery models. However, the regulators have failed to account for the surge in nationwide mergers and acquisitions of federally assisted and non-federally assisted treatment providers. The landscape in the substance abuse area is robust, but the laws, as they are currently structured, stifle corporate transactions. Unfortunately, the laws are not vague or forgiving. Therefore, counsel that are advising providers, need to be mindful of the restrictions against the disclosure of such protected health information in connection with a sale, merger or consolidation.