On February 9, 2016, the Substance Abuse and Mental Health Services Administration (“SAMHSA”) issued proposed rules to substantially revise its Confidentiality of Alcohol and Drug Abuse Patient Records regulations (“Proposed Rules”)1. The last substantive update to these regulations occurred in 1987, nearly 30 years ago, which was before the enactment of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Since that time, the health care industry has transformed and today there is a more integrated delivery of health care services that would have been impossible to predict in 1987. SAMHSA proposes these new regulations to facilitate the ability of patients with substance use disorders to participate in, and benefit from, the new integrated health care models while protecting these patients’ privacy. The Proposed Rules will impact entities that are currently considered to be federally assisted substance abuse programs as well as general medical facilities or practices that hold themselves out to provide substance use services. A copy of the Proposed Rules is available here.
Highlights of Proposed Changes
The Proposed Rules seek to modernize 42 CFR Part 2 (“Part 2”). While each of the proposed changes is important, one of the most significant changes is to the patient consent form. SAMHSA proposes to change the current patient consent provisions and allow a general designation in the “To Whom” section of the patient consent form. This change would permit the designation of an entity and a general designation of a class of participants so long as all participants have a treating relationship with the patient. Currently, the regulations do not allow a general designation to an entity that does not have a treating relationship with the patient. SAMHSA anticipates that flexibility on the “To Whom” section will increase patient participation in health information exchanges.
Due to this change, SAMHSA is proposing that the consent forms should contain specificity as to the records that will be disclosed. General language such as ”all of my records” and ”only my substance use disorder records my family knows about” will not be acceptable. However, SAMHSA states that language such as ”medications and dosages, including substance use disorder-related medications” and ”all of my substance use disorder-related claims/encounter data” will be acceptable.
Further, the Proposed Rules contemplate that patients who provide a general designation in the consent form’s “To Whom” section should be entitled, upon request, to a list of entities to which their information was disclosed. Such a request would have to be made in writing and the entities would have 30 calendar days to respond. An entity’s response to the patient may be sent either encrypted or unencrypted as long as the patient has been informed of the risks of an unencrypted communication.
Prohibition Against Re-Disclosures
The Proposed Rules also seek to clarify the prohibition against re-disclosures. Here, SAMHSA seeks to clarify that this prohibition only extends to information that would identify an individual as having been diagnosed, treated or referred for treatment of a substance use disorder. Therefore, the Part 2 covered program could re-disclose other information if permissible under applicable federal and state laws, including HIPAA.
The Proposed Rule seeks to expand the current Part 2 research exception that allows disclosure of patient information without patient consent for research purposes if certain conditions are met. These new exceptions generally rely on the researchers being a HIPAA covered entity or business associate. The researcher could also be subject to the HHS Common Rule (45 C.F.R. Part 46, subpart A) and must provide certain written documentation demonstrating compliance with the HHS Common Rule or that the researcher is subject to both HIPAA and the HHS Common Rule and that the research will be conducted in compliance with both regulations.
The Proposed Rules contain new security requirements that would apply to both paper and electronic records. Additionally, entities subject to Part 2 must have formal policies and procedures in place that reasonably protect against unauthorized use of disclosures of patient identifying information, as well as protect against reasonable threats to this information. Furthermore, these policies must address certain other items including the sanitization of written and electronic records. Proposed changes will also impact the audit and evaluation of both paper and electronic records.
The Proposed Rule also seeks to add and revise certain defined terms. Currently, the Part 2 regulations only apply to a program that is federally assisted and that holds itself out as providing certain substance use disorder diagnosis, treatment and referral for treatment but does not include general medical facilities. SAMHSA is looking to refine the definition of a program so that Part 2 applies to general medical facilities/practices if certain conditions are met, including if a unit within the general medical facility holds itself out as providing substance use disorder diagnosis, treatment or referral of treatment. Other newly defined terms and/or terms with updated meanings include, but are not limited to: substance use disorder, treating provider relationship, withdrawal management, patient, qualified service organization, records and treatment.
Providers should closely monitor the development of these Proposed Rules. In particular, providers should be aware of the potential impact that the Proposed Rules could have on them if they treat patients with substance use disorders. General medical facilities or practices should evaluate the substance use services they provide to determine if they will be subject to the Proposed Rules. Providers should also reevaluate their current policies and procedures that relate to substance use services to determine what revisions will be required. Providers must also consider that the Proposed Rules will not affect more restrictive state laws governing individuals who suffer from substance use disorders.
Providers that wish to submit comments on the Proposed Rules have until 5:00 PM EST on April 11, 2016.