Last month, the U.S. Department of Health and Human Services (“HHS”) Substance Abuse and Mental Health Services Administration (“SAMHSA”) released a Final Rule updating the Confidentiality of Alcohol and Drug Abuse Patient Records regulations at Title 42 of the Code of Federal Regulations Part 2 (“Part 2”). The Final Rule serves to modernize the regulations to facilitate information exchange and health integration while protecting the privacy of patients seeking treatment for substance use and the confidentiality of their medical records.
The Part 2 regulations were promulgated in 1975 to protect the identities of individuals seeking substance use treatment from possible negative social consequences and stigma that could deter individuals from seeking treatment. They have not been substantively updated since 1987. The Final Rule was intended to go into effect February 17, 2017; however a Trump administration memorandum issued in mid-January establishing a “regulatory freeze” has delayed the effective date for at least sixty days from the date of the memorandum. In response to this directive, SAMHSA has postponed the Final Rule’s effective date to March 21, 2017.
The updates to the Part 2 Regulations seek to enable improvements in healthcare research, integrated treatment, quality assessment, and the necessary exchange of healthcare information in response to major changes in the health care system over the last three decades. “These efforts clear the way for integrated health care models that can provide a better, more cost-effective health care system that also empowers people to make key decisions about their health care,” commented HHS Deputy Assistant Secretary, Kana Enomoto.
The Final Rule has made a number of key changes to the existing regulations. Under the current Part 2 Regulations, federally assisted substance use disorder programs must have the patient’s express consent to release any identifiable information related to substance use disorder diagnosis, treatment, or referral, even for information related to payment, treatment or healthcare operations (disclosures which are allowable under HIPAA, the Health Insurance Portability and Accountability Act of 1996). The Final Rule has made updates in a number of areas, including the following:
– Application: The Part 2 regulations continue to apply to federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral for treatment, including such programs that are part of general medical facilities.
– General disclosure designation: The Final Rule has made it possible for individuals to consent to the release of information by a general designation on the consent form for entities and individuals with a treating provider relationship (for example, “my treating providers”). This is a significant update from current requirements, which mandate that each individual or entity must be named separately on the consent form. The Final Rule also allows patients to designate whether such entities and individuals should be past, current, or future treating providers and the amount and type of information to be released (either broadly, such as all substance abuse information, or more narrowly, such as specific categories of information like medications or substance use history).
– List of disclosures: If patients have elected to make a general disclosure on their consent form, the Final Rule mandates that providers must provide them with a list of entities to whom their information has been disclosed, if the patient requests this information. Entities seeking to disclose information pursuant to the general disclosure designation may not do so unless they are able to provide the list of disclosures as required by the Final Rule.
– Research: The Final Rule allows that those lawfully in possession of patient identifying information may disclose information covered by the Part 2 regulations for research purposes to qualified personnel if the personnel meet certain regulatory requirements, and researchers are allowed to obtain data linkages to data sets from data repositories covering Part 2 data as long as certain regulatory requirements are met.
– Re-disclosure notification: The Final Rule has added language to the re-disclosure prohibition clarifying that re-disclosure is disallowed only for information that would directly or indirectly identify an individual as having been diagnosed, treated or referred for treatment for a substance use disorder.
– Qualified service organization definition: The Final Rule has expanded the definition of qualified service organizations (“QSOs”) to include entities that provide population health management services. These organizations can receive information from a provider under the Part 2 regulations without the patient’s express consent. The Final Rule, however, has narrowed QSOs from those that provide “medical services” to those that provide “medical staffing services.”
– Audit and evaluation: The Final Rule permits audits or evaluations to meet the requirements of accountable care organizations or other Centers for Medicare & Medicaid Services regulated entities.
– Record Security: The Final Rule mandates that Part 2 programs and other lawful holders of patient identifying information must have formal policies and procedures in place to ensure security for paper and electronic records.
The SAMHSA additionally issued a Supplemental Notice of Proposed Rulemaking addressing restrictions on lawful holders of Part 2 information and their contractors, subcontractors, and legal representatives in relation to payment and health care operations. Comments on the proposed rule were due February 17, 2017.
