On February 9, 2016, the Substance Abuse and Mental Health Services Administration (SAMHSA) published a proposed rule [PDF] to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations governing the confidentiality of substance abuse treatment information. Found in part 2 of title 42 of the CFR, these regulations are commonly referred to as “the Part 2 Regulations.” The proposed changes, once finalized, will be the first update to the Part 2 Regulations since 1987. Given the innovations in integrated care and advances in the health care delivery system, SAMHSA is updating the regulations to keep them aligned with movement toward innovations and integration in care delivery and to ensure patients benefit from such improvements while maintaining privacy protections of sensitive information related to substance abuse treatment. The key proposed changes are summarized below. Comments to the proposed rule are due by April 11, 2016.
Narrowing the Scope of Part 2 Programs
The Part 2 Regulations apply to a federally assisted alcohol or drug abuse program which “holds itself out as providing, and provides substance use disorder diagnosis, treatment, or referral for treatment….” While such programs have commonly been referred to as Part 2 Programs, SAMHSA now proposes to expressly incorporate such definition into the regulations. Further, SAMHSA proposes a definition to apply to the “holds itself out” requirement, which had always been lacking in the Part 2 Regulations. Under the proposed rule, holds itself out means any activity that would lead one to reasonably conclude that the individual or entity provides substance use disorder diagnosis treatment or referral for treatment including but not limited to: (1) authorization by the state or federal government (e.g., licensed, certified, registered) to provide, and provides, such services; or (2) advertisement, notices or statements relative to such services; or (3) consultation activities relative to such services.
SAMHSA recognizes that general medical facilities (e.g., hospitals, trauma centers, FQHCs) or general medical practices (e.g., primary care groups) often provide substance use disorder treatment incident to the provision of general health care and the frequency of such is likely to increase with the integration of general medical facilities and practices with other types of providers. Therefore, SAMHSHA proposes to carve out a general medical facility or general medical practice from the definition of a Part 2 Program. However, if a general medical facility or general medical practice has an identifiable unit which holds itself out as providing and provides substance use disorder treatment, that unit would constitute a Part 2 Program. Further if a provider consists of medical personnel or other staff in a general medical facility or general medical practice, and the primary function of the provider is substance use disorder diagnosis, treatment or referral for treatment and the provider’s medical personnel or other staff are identified as providers of such services by the general medical facility, the provider would constitute a Part 2 Program.
To reflect commonly used terminology, SAMHSA proposes to replace the terms alcohol abuse and drug abuse with the term substance use disorder, which will refer collectively to alcohol abuse and drug abuse, and, for consistency, will revise the title of the Part 2 Regulations to “Confidentiality of Substance Use Disorder Patient Records”.
Consent Requirements
In the continued spirit of removing unnecessary obstacles to a patient’s participation in an integrated care setting, such as an ACO, SAMHSA proposes certain changes intended to facilitate information sharing. Those changes focus primarily on the required written consent required prior to disclosure of Part 2 program records.
“To Whom”
While the intended recipient of the records would still need to be included, SAMHSA loosened its specificity requirement on consents, allowing for consents to reflect a general designation when there is a treating provider relationship, such as “my treating providers” or the name of an entity that employs or credentials treating providers, such as an ACO. Similarly, individuals may designate third-party payors by the entity name, such as Medicare. Further evidencing SAMHSA’s interest in flexibility is a new proposed allowance for entities without treating provider relationships. The proposal allows for patients to designate such entities on the consent form provided that at least one of the following is provided: (1) the name(s) of an individual participant(s); (2) the name(s) of an entity participant(s) that has a treating provider relationship with the patient whose information is being disclosed; or (3) a general designation of an individual or entity participant(s) or a class of participants that must be limited to those participants who have a treating provider relationship with the patient whose information is being disclosed. This will require the entity to keep track of treating provider relationships. Further, these entities, upon a patient’s request, must provide a list of the entities to which information was disclosed pursuant to the patient’s general designation. This disclosure requirement, which is somewhat similar to the accounting requirement under HIPAA, would not become effective until two years after the final rule’s effective date. Patients must make these requests in writing and may only request disclosures going back two years. Entities without treating provider relationships must respond within 30 days.
“Amount and Kind”
Due to the proposed additional flexibility on the consent form’s designation, SAMHSA proposes that the amount and kind of substance abuse treatment information be “explicitly” described such that individuals are aware of and/or reminded of the information they are consenting to be disclosed.
“From Whom”
Current regulations allow for a patient to consent to the disclosure by a category of facilities or from a single specified program. Moving forward, SAMHSA proposes requiring patients to actually name the Part 2 program(s) or other lawful holder of the patient identifying information who is permitted to make a disclosure. SAMHSA wants to avoid general designations in both the “To Whom” and “From Whom” fields.
New Consent Fields
SAMHSA proposes two new fields which would confirm patients’ understanding of the consent forms. The first proposed field would allow patients to indicate that they understand the terms of the consent. The second proposed field would allow patients who use a general designation in the “to whom” section to acknowledge their understanding of their right to request and obtain a list of entities to which their information has been disclosed pursuant to the general designation.
Qualified Service Organization
Currently, substance abuse treatment information may be disclosed without a consent to Qualified Service Organizations (QSOs) under certain circumstances. QSOs provide services to Part 2 programs pursuant to a Quality Service Organization Agreement (QSOA). In the proposed rule, SAMHSA proposes to include population health management as an example of a service a QSO could provide. To the extent a QSO falls within this exception due to its provision of population health management, it is important to note that the permitted disclosures of information could be made only to the organization’s office or unit responsible for population health management. Further, the disclosure of information is limited in scope to the permissible purpose for which it was originally disclosed. After executing a QSOA for population health management services, Part 2 programs may communicate patient information to the population health management services organization, but only as much as is needed to perform the services. It is important to keep in mind that the population health management services organization may re-disclose information received from a Part 2 program only if the patient executes a consent form.
Records
SAMHSA proposes to modernize the provisions addressing the maintenance, disclosure, access to, and use of written records by making them applicable to electronic records as well. Specifically, SAMHSA proposes deleting written from the heading of the regulatory provisions. SAMHSA also proposes to make clear that “both part 2 programs and other lawful holders of patient identifying information” must “have in place formal policies and procedures for the security of both paper and electronic records.” In addition, SAMHSA proposes updating the provisions for the disposition of records by discontinued programs to apply to both written and electronic records. The proposed rule would also add requirements for sanitizing paper and electronic records of discontinued programs.
Re-disclosure Prohibited
Given confusion in the industry regarding just how much of a patient’s record is subject to the Part 2 Regulations, SAMHSA proposes “to clarify that the prohibition on re-disclosure provision (§2.32) only applies to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder.” SAMHSA affirmatively states that the Part 2 Regulations do not prohibit the re-disclosure of other health-related information, such as high blood pressure, so long as the other information does not identify the patient as having or having had a substance use disorder. Providers should note that some illnesses which “are brought about by drug or alcohol abuse may reveal that a patient has a substance use disorder.” Prescription medication used to treat substance use disorders may also suggest that the patient has a substance use disorder. Further, the origin of the data may reveal information which would identify a patient as having or having had a substance use disorder. All of this information would be prohibited from being re-disclosed if it would identify a patient as having or having had a substance use disorder.
Medical Emergencies
SAMHSA proposes to better align the regulatory language regarding medical emergency exceptions with the corresponding statutory language. To that end, SAMHSA proposes to revise the exception so that “patient identifying information may be disclosed to medical personnel to the extent necessary to meet a bona fide medical emergency, in which the patient’s prior informed consent cannot be obtained.” SAMHSA expects that this revision will grant providers greater discretion in determining whether a bona fide medical emergency exists. When the medical emergency exception is relied upon, Part 2 programs must immediately document the information related to the medical emergency.
Research
SAMHSA’s proposes to relax the restrictions on research activities by allowing the disclosure of patient identifying information for purposes of scientific research provided an authorized person, such as the CEO or managing director, ensures certain requirements are met related to applicable HIPAA requirements and/or compliance with the human subject research regulations. The proposed rule also addresses a researcher’s ability to link to federal data sets.
SAMHSA further proposes that researchers be fully bound by these regulations and, if necessary, to resist in judicial proceedings any efforts to obtain access to patient records except as permitted by these regulations. This requirement means that researchers involved in a judicial proceeding are only required to disclose patient identifying information pursuant to a subpoena that is accompanied by a court order. In addition, SAMHSA proposes to limit a researcher’s ability to re-disclose patient identifying information except back to the individual or entity from whom that patient identifying information was obtained.
Ober|Kaler’s Comments
Relaxation of regulatory requirements is somewhat the trend in the wake of new and integrated care models, as strict regulations would frustrate the goals and benefits of such integrations and improved outcomes. While SAMHSA does provide this flexibility, it does so in a way that does not lose sight of the importance and necessity of privacy for this sensitive program, such that patients will not defer needed treatment due to confidentiality concerns.
Because these are the first revisions to the Part 2 Regulations in almost 30 years, it will be interesting to see whether the comments stay aligned with the proposed changes or whether commenters will attempt to raise other issues now that they have an apparent forum.
