On July 15, 2020, the Substance Abuse and Mental Health Services Administration (SAMHSA), a branch of the U.S. Department of Health and Human Services (HHS), published its much-anticipated final rule to revise 42 C.F.R. Part 2, a set of federal regulations governing the confidentiality of substance use disorder (SUD) patient records.
The final rule adopts many of the revisions set forth in the notice of proposed rulemaking SAMHSA published in August 2019 as part of HHS’s broader “Regulatory Sprint to Coordinated Care” campaign, and will become effective on August 14, 2020. The revisions do not alter the basic framework of Part 2 but are intended to resolve confusion regarding certain existing requirements and ease restrictions on the sharing of patient information for certain purposes.
The final rule makes significant changes that covered providers should carefully consider now. It is important, however, to understand that more changes are on the horizon. With passage of the Coronavirus Aid, Relief and Economic Security Act (CARES Act) in March of this year, Congress amended sections of the Part 2 authorizing statute requiring HHS to further revise the Part 2 regulations with respect to uses and disclosures of SUD records on or after March 27, 2021. The changes required by the CARES Act will more closely align the Part 2 consent provisions with the Health Insurance Portability and Accountability Act (HIPAA). Covered providers should carefully monitor future regulatory developments and understand SAMHSA’s recent final rule as imposing transitional standards. Following is a brief summary of the major changes and clarifications adopted in the final rule.
Background
Part 2 applies to any individual or entity that is federally assisted and holds itself out as providing, and actually provides, SUD diagnosis, treatment, or referral for treatment. The protections provided in Part 2 are meant to encourage individuals to seek treatment for SUDs without fear that their treatment information will be unnecessarily disclosed without their knowledge or permission.
The Part 2 regulations were first promulgated in 1975, long before the creation of the modern regulatory environment for health information privacy and security. Part 2 is stricter than the Health Insurance Portability and Accountability Act of 1996 (HIPAA) with respect to how patient information may be used and disclosed, and the lack of alignment between the two regulatory regimes has resulted in confusion and additional burden, particularly when Part 2 and non-Part 2 providers attempt to share information for care coordination.
Although SAMHSA has twice revised the Part 2 regulations since 2017 in an effort to provide for greater flexibility in disclosing patient information, the agency has signaled its intent to explore future rulemaking to better address the complexities of health information technology, patient privacy, and interoperability. The intensification of the opioid crisis and the growth in demand for SUD treatment services have further ratcheted up the need for regulatory reform. It is in this context that SAMHSA has made additional changes to Part 2 to better align it with the needs of individuals with SUD and of the providers who treat them.
Clarification Regarding When Records Are Subject to Part 2
The final rule amends the definition of “records” that are subject to Part 2 to exclude information conveyed orally by a Part 2 program to a non-Part 2 provider for treatment purposes with the consent of the patient, where such information is then reduced to writing by the non-Part 2 provider. Non-Part 2 providers also have expressed hesitancy in receiving Part 2 records in any form for fear of being made subject to Part 2 themselves. The purpose of this revision is to facilitate coordination of care activities between Part 2 programs and non-Part 2 providers. Records originating from a Part 2 program that are received by a non-Part 2 provider remain subject to Part 2 restrictions. Non-Part 2 providers may segregate these SUD records from the rest of their records to eliminate the risk that Part 2 would cover any subsequent records the non-Part 2 provider creates in response.
Revision to Requirements for Patient Consent to Disclose Part 2 Records to Entities
Under current regulations, SUD patients can consent to the release of their records to entities that have a treatment relationship with the patient or are a third-party payor. If the entity to which the patient requested their records be sent does not fall into one of those two categories, the patient is required to list the name of the specific individual at the entity to whom the records were being disclosed.
SAMHSA received reports that SUD patients often want Part 2 programs to disclose their records to entities for reasons such as eligibility determinations and seeking non-medical services or benefits from governmental or non-governmental entities (e.g., Social Security benefits, local sober living facilities). Since these entities lack a treatment relationship with the patient and are not third-party payors, the current regulatory regime precludes them from being designated to receive the information unless the individual is able to identify the specific individual who would receive the records on behalf of the entity, which is often not possible. Many patients have experienced frustration and delays in applying for and receiving such benefits as a result of their inability to name a specific individual to receive the records on behalf of the entity. The final rule amends the Part 2 regulations to permit patients to consent to the disclosure to an entity of their Part 2 records more broadly without naming a specific individual as the recipient of the disclosure.
Disclosures to Central Registries
Many opioid treatment programs (OTPs) use opioids such as methadone and buprenorphine to treat opioid use disorders — drugs that, if combined with other medications or used at higher than prescribed dosages, may have serious or even fatal side effects. Under Part 2, a “central registry” is an organization that obtains information from multiple Part 2 programs regarding individuals applying for withdrawal management or maintenance treatment for the purpose of avoiding an individual’s concurrent enrollment in more than one OTP. Under existing regulations, a Part 2 program is required to seek patient consent in order to disclose treatment records to a central registry, and the central registry could only disclose SUD records when asked by a Part 2 program whether an identified patient is enrolled in another Part 2 program.
The final rule expands the Part 2 regulations to allow non-OTP providers who have a treatment relationship with a patient to query a central registry to determine whether the patient is already receiving opioid treatment through a Part 2 program in order to prevent duplicative enrollments and prescriptions for excessive opioids. The purpose of this revision is to promote coordination of care between OTPs and non-OTP providers in order to try to prevent the over-prescription of opioids to individuals and to avoid potentially fatal drug interactions.
Disclosures to Prescription Drug Monitoring Programs
The vast majority of states now have a prescription drug monitoring program (PDMP), which is a statewide electronic database that collects, analyzes, and makes available prescription data on controlled substances prescribed by practitioners. Under current regulations, OTPs are not permitted to disclose SUD records to a PDMP unless an exception applies. SAMHSA explains that, in light of the current public health crisis arising from opioid misuse and abuse, it no longer believes this policy is advisable. The omission of OTP data from a PDMP may lead to potentially dangerous adverse events for patients who receive duplicate or potentially inappropriate prescriptions as part of medical care outside an OTP, thereby placing them at risk of adverse events such as an overdose or fatal drug interaction. The final rule revises the Part 2 regulations to permit OTPs and other lawful holders of Part 2 records to report SUD prescription data required by state law to their respective state PDMPs when dispensing medications, with the patient’s written consent.
Disclosures for Research
Under current regulations, Part 2 programs are permitted to disclose SUD records for research purposes without patient consent if the recipient is a HIPAA-covered entity or business associate that has obtained authorization from the patient or a waiver of authorization, consistent with the HIPAA Privacy Rule, or the recipient is subject to the HHS regulations regarding the protection of human subjects under the common rule. HHS has determined that limiting research disclosures in such a manner may make it more difficult for some legitimate stakeholders to obtain data from SUD records for the purpose of conducting scientific research. HHS will now allow disclosure of Part 2 data for research purposes from a HIPAA-covered entity or business associate to individuals and organizations who are neither HIPAA-covered entities, nor subject to the common rule, provided that the data is disclosed in accordance with the HIPAA Privacy Rule.
What’s Next?
The CARES Act requires HHS to further revise the parameters of Part 2 disclosures for treatment, payment, and healthcare operations (except deidentification and the creation of limited data sets) and disclosures of de-identified data to public health authorities. Those amendments will align the Part 2 consent provisions more closely with HIPAA and extend the HIPAA civil monetary penalties and breach notification provisions to Part 2 programs. Congress also added provisions that will prohibit recipients of federal funds from discriminating against individuals based on SUD records regulated under Part 2. HHS will revisit each of these issues in future rulemaking.
