Both routes OCR describes run through written consent, and in states using a three-month lookback, the months being verified have already started.
Key Takeaways
- What OCR answered: The agency addressed when a state Medicaid agency may use substance use records it already holds to verify that someone is excluded from the community engagement requirement.
- Consent either way: One route relies on a consent the treatment program already obtained for treatment, payment and operations; the other requires the agency to obtain its own written consent.
- Narrower than a diagnosis: People in recovery five years or longer fall outside the substance use category, and the condition has to interfere with meeting the requirement.
- The clock: States must implement the community engagement requirement no later than January 1, 2027.
The months that states will examine when Medicaid’s new work requirement takes effect have started running. A state that applies a three-month lookback to a beneficiary whose renewal falls in January 2027 will be looking at October, November and December of this year, and some states will apply the requirement at renewals initiated as early as November, according to the rule’s preamble. The paperwork that determines who is exempt is being assembled now.
Which gives unusual weight to a four-page guidance document the HHS Office for Civil Rights published in late September. It answers one question. When a state Medicaid agency already holds substance use disorder treatment records protected by 42 CFR Part 2, when may it use them to confirm that a beneficiary is excluded from the requirement?
The answer has two parts, and both run through patient consent. There is no third route. A state cannot search the Part 2 records already sitting in its claims system for people who qualify unless a consent covers that use, so a form signed in a treatment program’s intake office now sits inside the state’s eligibility process.
What the Part 2 Guidance Permits
The first permitted route is an existing consent. If a Part 2 program obtained a patient’s written consent covering all future uses and disclosures for treatment, payment and health care operations, and disclosed records to the state Medicaid agency under it, the agency may later use those records to verify an exclusion without going back for anything further. OCR grounds that in the definitions Part 2 borrows from HIPAA: payment includes determining eligibility or coverage under a health plan, and health care operations includes enrollment and disenrollment.
A second route runs through a new consent obtained by the agency itself, either for the narrow purpose of determining whether an exclusion applies or for all future uses of the same three kinds. A consent the agency obtains has to carry the elements required at 42 CFR 2.31(a), including the patient’s right to revoke it and an expiration date or event.
In its announcement, OCR said the guidance will help state Medicaid agencies “use information they already have to identify individuals who are excluded” while preserving Part 2’s confidentiality protections. Director Paula M. Stannard is quoted in the release.
Why the Intake Consent Form Became Eligibility Infrastructure
The practical weight of the guidance falls on treatment programs rather than on states. Verification duties already require a state to use reliable information available to it, including encounter data and payment data from the preceding 12 months, before asking the beneficiary for anything. Nothing in the document expands what a state may collect. It clarifies what a state may do with what the consent already allowed.
That makes the scope of the original consent decisive. A program whose form authorizes disclosure for payment alone, rather than for treatment, payment and health care operations generally, has given the state a record it may not be able to use for this purpose without new consent from the patient. Acuity reported in July that the overhauled Part 2 rule allows a single consent covering future disclosures for those purposes, and most programs have spent the year since February rewriting their forms. A paperwork decision made in February has become an eligibility outcome in January.
Why the Calendar Is Tighter Than January
The January 1 date describes when states must have the requirement running, not when the underlying months begin. CMS’s own illustration walks through the arithmetic: a beneficiary renewing in January 2027 in a state that looks back three months would need to show community engagement, or an exclusion, for October, November and December 2026. States are also required to conduct outreach to enrolled adults before implementation, and CMS has said that a state unable to verify someone must give that person 30 days to demonstrate compliance or an exemption before coverage ends.
Those 30 days are the window in which a treatment program is most likely to get a call from a patient or a caseworker. What the program can send, and whether the state can use what it already has, both depend on a consent signed earlier.
The Exclusion Is Narrower Than a Substance Use Diagnosis
Guidance footnotes carry a detail that providers advising patients should know. CMS set the definition of an individual who is medically frail or otherwise has special medical needs at 42 CFR 435.554(c)(5)(i), and excluded individuals in stable recovery, meaning five or more years, from the substance use category of that definition. Qualifying also requires that the condition significantly impair the individual’s ability to comply with the requirement.
A diagnosis alone does not produce the exclusion, in other words, which is the same point Acuity made when CMS issued the interim final rule in June. Consent and clinical documentation arrive as a single problem, and they land on the same programs.
What the Guidance Leaves Untouched
Records used under either route remain subject to Part 2’s prohibition on using them to initiate or substantiate criminal charges, or in civil, criminal, administrative or legislative proceedings against the patient. Those uses require a separate consent under 42 CFR 2.31(d). The prohibition travels with the records, which matters as this data moves through billing systems and vendor chains of the kind Acuity examined in its reporting on offshore billing and unmonitored AI tools. Nothing here carries the force of a rule, and the document does not alter the interim final rule published at 91 FR 33348 on June 3, which CMS issued with a comment period and which states must implement no later than January 1, 2027.
CMS had signaled this was coming. In the preamble to that rule, the agency acknowledged that identifying excluded individuals intersects with Part 2 and said it intended to work with OCR on technical assistance for states. The guidance, dated September 29, is that assistance, and OCR has added it to its Part 2 resource page.
The Advocacy Behind the Clarification
The Association for Behavioral Health and Wellness said it had urged OCR to issue the clarifications and that the document reflects two of its recommendations, including that an existing consent for treatment, payment and health care operations should satisfy the consent requirement for these determinations. President and Chief Executive Debbie Witchey said in the association’s statement that relying on a single existing consent would “protect patient privacy and safety and ensure exemptions are implemented without unnecessary barriers.”
ABHW is a trade group for health plans, with members including Aetna Behavioral Health, Centene, Elevance Health, Evernorth, Kaiser Permanente, Magellan Health, Molina Healthcare and Optum, and it leads a coalition that has pushed for years to align Part 2 more closely with HIPAA. Its interest in fewer consent barriers is longstanding and openly stated, which belongs alongside the claim of authorship.
For providers, none of this waits for January. States are finishing verification plans this quarter, the lookback months are already underway, and the patients most likely to qualify for this exclusion are the ones least equipped to produce documentation on demand, a problem Acuity has described in the context of coverage losses and of clinics paid on a cost basis that serve them. Whether those patients keep coverage may turn on language a program chose for its consent form months ago.
