On August 26, 2019, the Substance Abuse and Mental Health Services Administration, part of the U.S. Department of Health and Human Services (HHS), published its much-anticipated notice of proposed rulemaking to revise 42 C.F.R. Part 2, a set of federal regulations governing the confidentiality of substance use disorder (SUD) patient records.
The proposed rule, which is part of HHS’s broader “Regulatory Sprint to Coordinated Care” campaign, would not alter the basic framework of Part 2, but it would, if finalized, resolve confusion regarding certain existing requirements and ease restrictions on the sharing of patient information for certain purposes. Following is a brief summary of the major changes and clarifications outlined in the proposed rule.
Background
Part 2 applies to any individual or entity that is federally assisted and holds itself out as providing, and actually provides, SUD diagnosis, treatment or referral for treatment. The protections provided in Part 2 are meant to encourage individuals to seek treatment for SUDs without fear that their treatment information will be unnecessarily disclosed without their knowledge or permission.
The Part 2 regulations were first promulgated in 1975, long before the creation of the modern regulatory environment for health information privacy and security. Part 2 is stricter than the Health Insurance Portability and Accountability Act of 1996 (HIPAA) with respect to how patient information may be used and disclosed, and the lack of alignment between the two regulatory regimes has resulted in confusion and additional burden, particularly when Part 2 and non-Part 2 providers attempt to share information for care coordination.
While HHS has twice revised the Part 2 regulations since 2017 in an effort to provide for greater flexibility in disclosing patient information, it has signaled its intent to explore future rulemaking to better address the complexities of health information technology, patient privacy, and interoperability. The intensification of the opioid crisis and the growth in demand for SUD treatment services have further ratcheted up the need for regulatory reform. It is in this context that HHS now proposes additional changes to Part 2 to better align with the needs of individuals with SUD and of the providers who treat them while safeguarding confidentiality.
Clarification Regarding When Records Are Subject to Part 2
In the proposed rule, HHS would amend the definition of “records” that are subject to Part 2 to exclude information conveyed orally by a Part 2 program to a non-Part 2 provider for treatment purposes with the consent of the patient, where such information is then reduced to writing by the non-Part 2 provider. Non-Part 2 providers have often been hesitant to receive any information from a Part 2 program for fear of being made subject to Part 2 themselves. The purpose of this revision is to facilitate coordination of care activities between Part 2 programs and non-Part 2 providers. Records that originate from a Part 2 program that are received by a non-Part 2 provider would, however, remain subject to Part 2 restrictions and must be segregated from the rest of the non-Part 2 provider’s records.
Revision to Requirements for Patient Consent to Disclose Part 2 Records to Entities
Under the current Part 2 regulations, SUD patients may consent to the release of their records to entities that have a treatment relationship with the patient or are a third-party payor. If the entity to which the patient requests their records be sent does not fall into one of those two categories, the patient must list the name of the specific individual at the entity to whom the records are being disclosed.
HHS has received reports that SUD patients often want Part 2 programs to disclose their records to entities for reasons such as eligibility determinations and seeking non-medical services or benefits from governmental or non-governmental entities (e.g., Social Security benefits, local sober living facilities). Since these types of entities lack a treatment relationship with the patient and are not third-party payors, the current rules preclude them from being designated to receive the information unless the individual is able to identify the specific individual who would receive the records on behalf of the entity, which is often not possible. Many patients have experienced frustration and delays in applying for and receiving such benefits as a result of their inability to name a specific individual to receive the records on behalf of the entity.
In the proposed rule, HHS states that it is not its intent to limit patients’ ability to consent to the disclosure of their own records, and therefore proposes to amend the Part 2 regulations to permit patients to consent to the disclosure of their Part 2 records to an entity without naming a specific individual as the recipient of the disclosure.
Disclosures to Central Registries
Many opioid treatment programs (OTPs) use opioids such as methadone and buprenorphine to treat opioid use disorders — drugs that, if combined with other medications or used at higher than prescribed dosages, may have serious and even fatal side effects. Under Part 2, a “central registry” is an organization that obtains information from multiple Part 2 programs regarding individuals applying for withdrawal management or maintenance treatment for the purpose of avoiding an individual’s concurrent enrollment in more than one OTP. Under the current Part 2 regulations, a Part 2 program may seek patient consent in order to disclose treatment records to a central registry, and the central registry may only disclose SUD records when asked by a Part 2 program whether an identified patient is enrolled in another Part 2 program.
In the proposed rule, HHS seeks to expand the Part 2 regulations to allow non-OTP providers who have a treatment relationship with a patient to query a central registry to determine whether the patient is already receiving opioid treatment through a Part 2 program in order to prevent duplicative enrollments and prescriptions for excessive opioids. The purpose of this revision is to promote coordination of care between OTPs and non-OTP providers in order to try to prevent the over-prescription of opioids to individuals and to avoid potentially fatal drug interactions.
Disclosures to Prescription Drug Monitoring Programs
The vast majority of states now have a prescription drug monitoring program (PDMP), which is a statewide electronic database that collects, analyzes, and makes available prescription data on controlled substances prescribed by practitioners. Under the current Part 2 regulations, OTPs are not permitted to disclose SUD records to a PDMP unless an exception applies. HHS explains that, in light of the current public health crisis arising from opioid misuse and abuse, it no longer believes this policy is advisable. The omission of OTP data from a PDMP may lead to potentially dangerous adverse events for patients who receive duplicate or potentially inappropriate prescriptions as part of medical care outside an OTP, thereby placing them at risk of adverse events such as an overdose or fatal drug interaction. The proposed rule would revise the Part 2 regulations to permit OTPs and other lawful holders of Part 2 records to report the required data to their respective state PDMPs when dispensing medications, with the patient’s written consent.
Disclosures for Research
Under current regulations, Part 2 programs are permitted to disclose SUD records for research purposes without patient consent if the recipient is a HIPAA-covered entity or business associate that has obtained authorization from the patient or a waiver of authorization, consistent with the HIPAA Privacy Rule, or the recipient is subject to the HHS regulations regarding the protection of human subjects under the common rule. HHS has determined that limiting research disclosures in such a manner may make it more difficult for some legitimate stakeholders to obtain data from SUD records for the purpose of conducting scientific research. As a result, HHS is proposing to allow disclosure of Part 2 data for research purposes from a HIPAA-covered entity or business associate to individuals and organizations who are neither HIPAA-covered entities, nor subject to the common rule, provided that the data is disclosed in accordance with the HIPAA Privacy Rule.
Comments Due October 25, 2019
HHS invites interested parties to provide comments on the provisions of the proposed rule, which HHS will take into consideration when issuing the final rule amending the Part 2 regulations. Comments may be submitted electronically through the Federal eRulemaking Portal or by mail to the Substance Abuse and Mental Health Services Administration. Comments must be received no later than 5 p.m. EST on October 25, 2019, in order to be considered.
