OCR Issues Guidance on Disclosing SUD Records to Verify Medicaid Work Requirement Exclusions

With the Medicaid work requirements implementation date of January 1, 2027, fast approaching, the Office for Civil Rights (“OCR”) recently issued a guidance document on the consent requirements for disclosing substance use disorder (“SUD”) records protected by 42 CFR Part 2 (“Part 2”).

Under the statute and CMS's Interim Final Rule, certain adults ages 19–64 must complete 80 hours per month of work, community service, or other qualifying activities, or be enrolled at least half-time in education, to remain eligible for Medicaid (the “Medicaid work requirements”).

There are limited exclusions to the work requirements, including for people who are medically frail or have special medical needs, a category that covers certain individuals with SUD and people participating in certain SUD treatment programs. Importantly, the exceptions for individuals with SUD do not apply to those in "stable recovery" of five or more years.

States must verify compliance and exclusions using reliable information they already have, such as encounter and claims data, without asking the individual for more documentation where possible. For many individuals with SUD, that information will include SUD records protected by Part 2.

OCR’s new guidance identifies two consent-based pathways for a state Medicaid agency to use Part 2 protected records to confirm that someone is excluded:

1. A state Medicaid agency may use Part 2 records to verify an exclusion when a Part 2 Program previously obtained the patient's written consent for all future uses and disclosures for treatment, payment, and health care operations (a "TPO consent"). According to OCR, determining eligibility falls within "payment" and enrollment falls within "health care operations." The Part 2 program must send a copy of the consent, or a clear explanation of its scope, along with the records, as required under 42 CFR 2.32(b).
2. A state Medicaid agency may obtain separate written consent from the applicant or beneficiary. The consent may be limited to exclusion determinations or it can be a broader TPO consent covering records the agency already holds, including records it received under a narrower consent, such as one limited to payment. Any consent the agency obtains must include all the elements required by 42 CFR 2.31(a), including the patient's right to revoke and an expiration date or event.

Under either route, Part 2's core protection still applies: Part 2 protected records cannot be used to investigate or bring criminal, civil, administrative, or legislative proceedings against the patient without a separate, specific consent.

For health centers and other organizations that operate Part 2 Programs, this guidance provides a good reason to review consent practices before states begin verification:

• If your TPO consent forms are complete and your disclosures to Medicaid include the required copy or explanation of the consent and the Part 2 notice statement, the state may be able to verify a patient's exclusion without asking for more paperwork. That can help protect coverage for patients who are among the most at risk of losing it.
• If your organization has not implemented TPO consent forms, patients may be asked to sign a new consent form with the state or to verify their exclusion some other way, which could delay the verification process and impact their coverage.

If you have questions about updating your consent forms or disclosure workflows, please contact us.