Proposed Changes Affect Privacy Protections of Patients Seeking Substance Use Disorder Treatment

Firm Publication

On August 22, 2019, providers and other health industry participants involved in the provision of substance use disorder (SUD) services got some welcome news in the form of proposed regulatory changes. The U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration (SAMHSA) issued a proposed rule to implement modifications to the Confidentiality of Substance Use Disorder Patient Records regulations at 42 CFR Part 2 (the Part 2 regulations), which impose strict limitations on the use and sharing of patient-identifying SUD information and were initially issued in 1975. SAMHSA’s proposed changes are in part a response to the consequences of the opioid crisis, as the constraints of the Part 2 regulations may pose challenges to the coordination of care for patients with SUD. The proposed changes are intended to allow information sharing as necessary to treat the complexities of SUD while also protecting the confidentiality of those seeking treatment.

The Part 2 regulations apply primarily to federally assisted providers of SUD treatment, diagnosis and referral for treatment (including facilities, medical personnel and specialized units within inpatient settings). The regulations also impact those who receive patient-identifying information from SUD providers and other lawful holders of such information.

In recent years, providers and other stakeholders have advocated for revisions to the Part 2 regulations, both to better integrate SUD records into the overall electronic health record framework and to support the sharing of information for care coordination and outcomes assessment across different types of providers. Earlier this month, the National Association of Attorneys General asked Congress to overhaul the regulation to address the opioid epidemic. Many providers have also requested greater synchronization between the Part 2 regulations and the HIPAA privacy and security requirements.

The following is a high-level summary of the more significant proposed changes to the Part 2 regulations under the Proposed Rule. HHS and SAMHSA will accept public comments until 5:00 P.M. Eastern on October 25, 2019.

  1. Applicability/Re-disclosure. The Proposed Rule includes changes that would clarify and arguably narrow the applicability of the Part 2 regulations. Written treatment records created by a non-Part 2 provider (for example, a primary care physician) based on oral encounters with patients would not be covered by the Part 2 regulations unless the provider’s written records incorporate SUD treatment records received directly from a Part 2 program. Records received from a Part 2 program that are segregated from the provider’s treatment records would not cause the provider’s records to become subject to the Part 2 regulations. Further, the Proposed Rule states that a non-Part 2 treating provider’s recording of information about a SUD and its treatment that identifies a patient would not constitute a record that has been re-disclosed under Part 2. The Proposed Rule does not clearly address the impact on other, non-provider healthcare industry participants that may receive records from Part 2 programs. However, SAMHSA states in preamble commentary that a non-Part 2 entity may record information about a SUD and its treatment without those records becoming covered by the Part 2 regulations, provided the “original record” received from the Part 2 program or another lawful holder is segregated. It is unclear whether these changes would permit lawful holders, such as a health plan, to segregate “original records” received in connection with claims for payment received from Part 2 programs and use records created by such lawful holders for other purposes, such as disease management and provider outreach.
  2. Consent Requirements. The Part 2 regulations prohibit a program from disclosing patient identifying information unless the patient has consented in writing or a very limited exception applies. Currently, the consent requirement contains strict standards that require identifying the specific individual recipient of the records in most cases, which is seldom practical. For example, a patient receiving SUD treatment may not know the name of the individual at a government agency who will receive the records for the individual to apply for benefits. The Proposed Rule would allow a patient to consent to disclosure to an entity (i.e. the Social Security Administration), without listing a specific person.
  3. Disclosures for Payment and Health Care Operations Purposes. The Part 2 regulations currently state that if a patient consents to a disclosure of records for payment and/or health care operations activities, the lawful holder who receives the records may further disclose those records as necessary for its contractors, subcontractors, or legal representatives to carry out payment and/or health care operations on its behalf. To resolve ambiguity regarding which activities count as “payment and/or health care operations” under the Part 2 regulations, the Proposed Rule would add a list of 17 examples of such activities including billing, claims management, clinical professional support services, patient safety activities, training, and accreditation. This list is intended to be non-exhaustive. Despite SAMHSA’s stated intent to promote coordination of care, SAMHSA expressly states in the preamble that care coordination and care management are not included as permissible payment and health care operation activities under the Part 2 regulations (even though they are permissible without authorization under HIPAA).
  4. Disclosures to Central Registries and PDMPs. Under the Proposed Rule, non-opioid treatment program providers would have the option to refer to a central registry to determine if patients they see are already receiving opioid treatment through another program. Further, an opioid treatment program provider would be permitted to enroll in a state prescription drug monitoring program (PDMP) through which it would report data when prescribing/dispensing patient medications that are listed on Schedules II through V.
  5. Audit and Evaluation. The Proposed Rule would expand and clarify the situations that qualify for the audit and evaluation exception. SAMHSA proposes modifying the exception so that permissible disclosures include reviews at the agency or plan level regarding improvements, reviews of medical necessity, internal reviews within an organization or its parent, and reviews by accreditation agencies. However, SAMHSA takes the position that this exception is narrower than the HIPAA exception for disclosures for public health purposes and does not permit disclosures to support care coordination.
  6. Medical Emergencies. The Proposed Rule would clarify the exception permitting disclosures of patient information in the event of a medical emergency to state that natural disasters meet the definition of a “bona fide medical emergency.”
  7. Research. The Proposed Rule would revise the existing exception for research disclosures to be more consistent with the HIPAA research exception. Instead of limiting the exception to disclosures for research made to HIPAA covered entities and business associates, the Proposed Rule would also permit disclosures to be made to other entities provided that the disclosure complies with the HIPAA research exception (45 CFR §164.512(i)).

For SUD providers and other healthcare industry participants that receive or would like to receive SUD-related information, the Proposed Rule includes many helpful provisions. However, the SUD industry will likely continue to advocate for legislative changes to more closely align the Part 2 information-sharing restrictions with HIPAA. Even if Congress does enact such legislation, restrictive state laws may remain a barrier, since several states have enacted laws and regulations that are based on the current version of the Part 2 regulations and related laws.

If you have any questions regarding the Part 2 regulations or how to submit comments to SAMHSA, please contact the authors or one of our healthcare attorneys.

Related Professionals
Related Services
Firm Publication

On August 22, 2019, providers and other health industry participants involved in the provision of substance use disorder (SUD) services got some welcome news in the form of proposed regulatory changes. The U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration (SAMHSA) issued a proposed rule to implement modifications to the Confidentiality of Substance Use Disorder Patient Records regulations at 42 CFR Part 2 (the Part 2 regulations), which impose strict limitations on the use and sharing of patient-identifying SUD information and were initially issued in 1975. SAMHSA’s proposed changes are in part a response to the consequences of the opioid crisis, as the constraints of the Part 2 regulations may pose challenges to the coordination of care for patients with SUD. The proposed changes are intended to allow information sharing as necessary to treat the complexities of SUD while also protecting the confidentiality of those seeking treatment.

The Part 2 regulations apply primarily to federally assisted providers of SUD treatment, diagnosis and referral for treatment (including facilities, medical personnel and specialized units within inpatient settings). The regulations also impact those who receive patient-identifying information from SUD providers and other lawful holders of such information.

In recent years, providers and other stakeholders have advocated for revisions to the Part 2 regulations, both to better integrate SUD records into the overall electronic health record framework and to support the sharing of information for care coordination and outcomes assessment across different types of providers. Earlier this month, the National Association of Attorneys General asked Congress to overhaul the regulation to address the opioid epidemic. Many providers have also requested greater synchronization between the Part 2 regulations and the HIPAA privacy and security requirements.

The following is a high-level summary of the more significant proposed changes to the Part 2 regulations under the Proposed Rule. HHS and SAMHSA will accept public comments until 5:00 P.M. Eastern on October 25, 2019.

  1. Applicability/Re-disclosure. The Proposed Rule includes changes that would clarify and arguably narrow the applicability of the Part 2 regulations. Written treatment records created by a non-Part 2 provider (for example, a primary care physician) based on oral encounters with patients would not be covered by the Part 2 regulations unless the provider’s written records incorporate SUD treatment records received directly from a Part 2 program. Records received from a Part 2 program that are segregated from the provider’s treatment records would not cause the provider’s records to become subject to the Part 2 regulations. Further, the Proposed Rule states that a non-Part 2 treating provider’s recording of information about a SUD and its treatment that identifies a patient would not constitute a record that has been re-disclosed under Part 2. The Proposed Rule does not clearly address the impact on other, non-provider healthcare industry participants that may receive records from Part 2 programs. However, SAMHSA states in preamble commentary that a non-Part 2 entity may record information about a SUD and its treatment without those records becoming covered by the Part 2 regulations, provided the “original record” received from the Part 2 program or another lawful holder is segregated. It is unclear whether these changes would permit lawful holders, such as a health plan, to segregate “original records” received in connection with claims for payment received from Part 2 programs and use records created by such lawful holders for other purposes, such as disease management and provider outreach.
  2. Consent Requirements. The Part 2 regulations prohibit a program from disclosing patient identifying information unless the patient has consented in writing or a very limited exception applies. Currently, the consent requirement contains strict standards that require identifying the specific individual recipient of the records in most cases, which is seldom practical. For example, a patient receiving SUD treatment may not know the name of the individual at a government agency who will receive the records for the individual to apply for benefits. The Proposed Rule would allow a patient to consent to disclosure to an entity (i.e. the Social Security Administration), without listing a specific person.
  3. Disclosures for Payment and Health Care Operations Purposes. The Part 2 regulations currently state that if a patient consents to a disclosure of records for payment and/or health care operations activities, the lawful holder who receives the records may further disclose those records as necessary for its contractors, subcontractors, or legal representatives to carry out payment and/or health care operations on its behalf. To resolve ambiguity regarding which activities count as “payment and/or health care operations” under the Part 2 regulations, the Proposed Rule would add a list of 17 examples of such activities including billing, claims management, clinical professional support services, patient safety activities, training, and accreditation. This list is intended to be non-exhaustive. Despite SAMHSA’s stated intent to promote coordination of care, SAMHSA expressly states in the preamble that care coordination and care management are not included as permissible payment and health care operation activities under the Part 2 regulations (even though they are permissible without authorization under HIPAA).
  4. Disclosures to Central Registries and PDMPs. Under the Proposed Rule, non-opioid treatment program providers would have the option to refer to a central registry to determine if patients they see are already receiving opioid treatment through another program. Further, an opioid treatment program provider would be permitted to enroll in a state prescription drug monitoring program (PDMP) through which it would report data when prescribing/dispensing patient medications that are listed on Schedules II through V.
  5. Audit and Evaluation. The Proposed Rule would expand and clarify the situations that qualify for the audit and evaluation exception. SAMHSA proposes modifying the exception so that permissible disclosures include reviews at the agency or plan level regarding improvements, reviews of medical necessity, internal reviews within an organization or its parent, and reviews by accreditation agencies. However, SAMHSA takes the position that this exception is narrower than the HIPAA exception for disclosures for public health purposes and does not permit disclosures to support care coordination.
  6. Medical Emergencies. The Proposed Rule would clarify the exception permitting disclosures of patient information in the event of a medical emergency to state that natural disasters meet the definition of a “bona fide medical emergency.”
  7. Research. The Proposed Rule would revise the existing exception for research disclosures to be more consistent with the HIPAA research exception. Instead of limiting the exception to disclosures for research made to HIPAA covered entities and business associates, the Proposed Rule would also permit disclosures to be made to other entities provided that the disclosure complies with the HIPAA research exception (45 CFR §164.512(i)).

For SUD providers and other healthcare industry participants that receive or would like to receive SUD-related information, the Proposed Rule includes many helpful provisions. However, the SUD industry will likely continue to advocate for legislative changes to more closely align the Part 2 information-sharing restrictions with HIPAA. Even if Congress does enact such legislation, restrictive state laws may remain a barrier, since several states have enacted laws and regulations that are based on the current version of the Part 2 regulations and related laws.

If you have any questions regarding the Part 2 regulations or how to submit comments to SAMHSA, please contact the authors or one of our healthcare attorneys.

In Case You Missed It: