I. Executive Summary
The Substance Abuse and Mental Health Services Administration (“SAMHSA”), an agency within the U.S. Department of Health and Human Services (“HHS”), recently finalized its changes to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (42 CFR Part 2, or “Part 2 Regulations” or “Part 2”). These changes, which are set to become effective on February 17, 2017, are intended to facilitate health integration and information exchange within new health care models while continuing to protect the privacy and confidentiality of patients seeking treatment for substance use disorders. Although the effective date of the changes may be delayed by the new administration, health care entities that receive federal assistance and provide substance abuse treatment must be aware of the changes and prepare for their implementation to achieve compliance with the Part 2 Regulations.
II. Details of SAMHSA’s Changes
On January 18, 2017, SAMHSA published its changes to the Part 2 Regulations in the Federal Register. The modified regulations (“Final Rule”), carrying a new name, the “Confidentiality of Substance Use Disorder Patient Records,” had not been updated since 1987. The modifications contained in the Final Rule aim to:
- facilitate the exchange of substance use disorder information for treatment and other legitimate health care purposes;
- facilitate health integration within new health care models while ensuring appropriate confidentiality and privacy protections for records that might identify an individual, directly or indirectly, as seeking treatment for substance use disorders; and
- address concerns about the potential use of substance abuse information against an individual, which could prevent such an individual from seeking needed treatment for a substance use disorder.
The Final Rule is set to become effective on February 17, 2017. However, President Donald J. Trump issued a statement on January 23, 2017, requesting that agencies temporarily postpone the effective date of recently published regulations that have not yet taken effect, for 60 days from January 23, 2017, for the purpose of reviewing questions of fact, law, and policy that they raise. Therefore, there is a possibility that the Final Rule may not take effect until March 24, 2017.
Concurrent with the announcement of the Final Rule, SAMHSA issued a Supplemental Proposed Rule to seek comment on points included in the Final Rule that require additional clarification and other revisions. One area of comment on which SAMHSA is focusing in the Supplemental Proposed Rule concerns restrictions on lawful holders and their contractors’, subcontractors’, and legal representatives’ use and disclosure of Part 2-covered data for purposes of carrying out payment, health care operations, and other health care-related activities. SAMHSA is providing a 30-day comment period for the Supplemental Proposed Rule. Accordingly, comments are due on February 17, 2017.
The Part 2 Regulations, which implemented the federal drug and alcohol confidentiality law (42 U.S.C. § 290dd-2), protects the confidentiality of the identity, diagnosis, prognosis, or treatment of any patient records maintained in connection with the performance of any federally assisted program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research. The law and regulations were first written in 1975, when there was great concern about the potential for substance use disorder information being used against an individual. Since then, and since the last substantive update to the regulations in 1987, the health care industry has experienced significant changes that have impacted the delivery of care, including:
- the development of new models of integrated care that are built on a foundation of information sharing to support the coordination of patient care,
- the development of an electronic infrastructure for managing and exchanging patient information, and
- a new focus on performance measurement to determine the success of health care programs and intervention.
The unrevised Part 2 Regulations required, with respect to federally assisted programs or activities, stringent patient consent requirements for disclosure; provided no exceptions for the disclosure of information in regard to treatment, health care operations, or payment purposes; and restricted patients from taking full advantage of new health care models due to these strict requirements. In the Final Rule, SAMHSA updated the regulations to (i) provide patients with substance use disorders who participate in federally assisted programs or activities the ability to participate in, and benefit from, new integrated health care models without fear of putting themselves at risk of adverse consequences, such as discrimination or other social consequences for the improper disclosure of health information; (ii) facilitate information exchanged within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder; and (iii) make the regulations more understandable and less burdensome for the disclosure of patient information.
On February 9, 2016, SAMHSA published a notice of proposed rulemaking that proposed revisions to the old rule. During the 60-day public comment period, SAMHSA received 376 public comment submissions regarding the modification of Part 2 that addressed the complex issues addressed in the Part 2 Regulations from health care providers, behavioral health care providers, third-party payers, privacy/consumer advocates, accountable care organizations (“ACOs”), researchers, etc. The Final Rule reflects SAMHSA’s consideration of all substantive issues raised in the public comments and carefully balances the public benefits of information exchange while continuing to protect patient privacy across 14 updated regulatory provisions.
A summary of the major provisions that have been modified and finalized in the Final Rule include the following:
- Definitions. Changes to terminology throughout Part 2, as reflected in Section 2.11, set out to improve clarity, consistency, and modernization of the regulations through the revision of certain terms and the addition of certain definitions. For instance, the definition of “Qualified Service Organization” (“QSO”) has been revised from its original version to include population health management in the list of examples of services that a QSO may provide so that pertinent patient information may be shared with third-party vendors supporting population health initiatives without patient consent.
- Consent Requirements. Section 2.31 has been revised to allow a patient to include a general designation in the “To Whom” section of the consent form (e.g. “my treating providers, past or present”) to allow patients to benefit from integrated health care systems, while respecting patient choice, confidentiality, and privacy as patients do not have to consent to such disclosures. Additionally, the consent form must include a description of how much, and what kind of, information can be disclosed, including an explicit description of the substance use disorder treatment information that may be disclosed. Additionally, SAMHSA revised Section 2.31 to permit electronic signatures to the extent that they are not prohibited by any applicable law.
- Confidentiality Restrictions and Safeguards. Section 2.13 adds that, upon request, patients who have included a general designation in the “To Whom” section of their consent form (see Section 2.31) must be provided a list of entities, referred to as a “List of Disclosures,” to which their information has been disclosed pursuant to the general designation.
- Research. Section 2.52 now permits the lawful holder of patient identifying information to disclose Part 2 patient identifying information to qualified personnel without patient consent for purposes of conducting scientific research if the researcher meets certain regulatory requirements (e.g., if a Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) covered entity or business associate has obtained a HIPAA-compliant authorization (or a waiver from an Institutional Review Board (“IRB”) consistent with the HIPAA requirements) or meets other HHS human subject protection requirements). In order to enable more research on substance abuse disorders, data linkages will also be permitted to allow researchers to link to data sets from data repositories holding Part 2 data, provided that the researcher obtains IRB approval and agrees that such information will not be provided to law enforcement.
- Audit and Evaluation. Section 2.53 now includes procedures for federal, state, or local government agencies providing financial assistance to the Part 2 program to have access to the records, without a patient’s consent, in order to audit and evaluate activities, such as financial and quality assurance functions critical to ACOs and other health care organizations.
With implementation of this revised Part 2 in the Final Rule, all Part 2 programs and other lawful holders of patient identifying information will be required to comply with all aspects of the regulations, beginning February 17, 2017—30 days after publication of the Final Rule, or March 24, 2017 if President Trump’s order stands. Compliance with the Final Rule includes adhering to the List of Disclosures Requirements as promulgated in Section 2.13(d).
The implementation of the Final Rule has been met with some opposition in the industry. For instance, some commenters argued that the Final Rule’s requirements— specifically, the maintenance of a disclosure list of entities that have received patient information—are inconvenient and burdensome for the health care entity to maintain. Other commenters were concerned that loosening the Part 2 regulatory requirements will dissuade individuals with substance use disorders from seeking treatment out of fear of how their information may be used against them. Additionally, some commenters argued that maintaining a separate set of confidentiality restrictions aimed solely at substance use disorder providers and patients perpetuates the discrimination associated with substance abuse disorders, and negatively impacts patients and their care.
HHS stated that the Final Rule is intended to provide for greater flexibility in disclosing Part 2 patient identifying information within the health care system, while continuing to address the privacy concerns of patients seeking treatment for a substance use disorder. The purpose of the Part 2 revisions are to ensure that patients receiving treatment for a substance use disorder in a Part 2 program are not made more vulnerable than an individual with a substance use disorder who does not seek treatment. However, balancing the interests between the integration of the delivery of health care (by making the disclosure of patient health information easier), while maintaining the confidentiality of patients being treated with a substance abuse disorder may prove difficult. There is evidence that people being treated for substance abuse disorders will benefit from the integration of health care delivery in regard to their physical health. However, a patient’s perception (real or imagined) of the stigma associated with such treatment requires providers to maintain vigilance in protecting the patient’s personal health information.
Regardless of these concerns, health care entities that receive federal assistance and provide substance abuse treatment should be aware of the Final Rule and its requirements. Further, regardless of when the Final Rule actually takes effect (whether on February 17, 2017, or March 24, 2017), such entities have limited time to achieve compliance to these new regulations, and getting up to speed on their requirements will be paramount to the success of their implementation.