January 18, 2017
By Purvi Maniar and Lesley Yeung*
On Friday, January 13, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued a Final Rule to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (Part 2 Regulations). Concurrently, SAMHSA issued a Supplemental Proposed Rule addressing additional clarifications to the Part 2 Regulations, as amended by the Final Rule. The provisions in the Final Rule are effective February 17 and comments on the Proposed Rule are due by February 17.
Policy Updates in the Final Rule
Under the existing Part 2 Regulations, a federally assisted substance use disorder program generally may only release identifiable information related to substance use disorder diagnosis, treatment, or referral for treatment with an individual’s express consent. Even disclosures related to payment, treatment, or health care operations, which are permissible under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) without patient authorization, require express consent.
In the Final Rule, SAMHSA is updating the existing regulations, which have not been substantively changed since 1987, in order to: (1) enable patients with substance use disorders to better participate in, and benefit from new integrated health care models; (2) facilitate information exchange within new health care models; and (3) make the regulations more understandable and less burdensome.
The Final Rule amends a number of provisions within the existing regulations, including the following:
- Applicability: The Part 2 Regulations will continue to apply to a program that is federally assisted and holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment, including an identified unit or medical personnel or other staff within a general medical facility. SAMHSA had proposed to add “general medical practices” to the definition of a Part 2 Program, but did not finalize this proposal. The Final Rule applies the Part 2 Regulations to records in the possession of “other lawful holders of patient identifying information” (e.g. individuals or entities who receive such records pursuant to a Part 2-compliant patient consent).
- Consent Requirements: The Final Rule allows patients to include a general designation for individuals and/or entities with a treating provider relationship (e.g., “my treating providers”) in the “To Whom” section of the consent form, to allow for their records to be disclosed to such providers. This is a significant revision to the existing regulations which require each provider be specifically named in the consent form. However, the amount and kind of substance use disorder treatment information that may be disclosed must be specified on the consent form. This could be specified broadly, e.g “all my substance use disorder information” or more granularly, e.g., medications, substance use history, employment information, living situation, and/or social supports.
- Confidentiality Safeguards: The Final Rule requires that patients who have agreed to a general disclosure designation in the “To Whom” section of their consent form must have the option to receive a list of entities to whom their information has been disclosed, if requested. For entities that would disclose Part 2 information pursuant to a general designation on a patient’s consent form (e.g., accountable care organizations, health information exchanges), the Final Rule requires that they may not do so until they have the ability to comply with the “List of Disclosures” provision.
- Prohibition on Re-Disclosure: The Final Rule adds language to the existing re-disclosure notification to clarify that the prohibition on re-disclosure of a patient’s information only applies to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, such as indicated through standard medical codes, descriptive language, or both.
- Qualified Service Organization: The Final Rule expands the definition of a qualified service organization, which can receive information from a Part 2 provider without express patient consent, to include entities that provide population health management services, but not care coordination services, to a Part 2 program.
- Research: The Final Rule allows any lawful holder of patient identifying information to disclose Part 2 data to qualified personnel for purposes of conducting scientific research so long as the researcher meets certain regulatory requirements related to other existing protections for human research (e.g., the researcher is subject to patient authorization and/or privacy protections under the HIPAA Privacy Rule or the Common Rule). Researchers holding Part 2 data are permitted to obtain data linkages to other data sets from data repositories holding Part 2 data if certain regulatory requirements are met.
- Audit and Evaluation: The Final Rule permits a Centers for Medicare & Medicaid Services (CMS)-regulated accountable care organization or Qualified Entity (e.g., an entity allowed to receive standardized extracts of Medicare data) to receive Part 2 data for purposes of conducting a required audit or evaluation without patient consent, under certain conditions, including having a signed participation agreement with CMS.
Areas for Comment in the Supplemental Proposed Rule
SAMHSA is seeking comments on several additional proposals to address and clarify questions regarding restrictions on lawful holders and their contractors, subcontractors, and legal representatives’ use and disclosure of Part 2-covered data for purposes of carrying out payment, health care operations, and other health care related activities.
Specifically, SAMHSA seeks comments on its proposals to:
- Consider whether it would be appropriate to add an abbreviated re-disclosure notice and in which circumstances the shorter notice may be warranted;
- Define and limit the circumstances in which certain disclosures for the purposes of payment and health care operations can be made; and
- Expressly address further disclosures by contractors, subcontractors, and legal representatives for purposes of carrying out a Medicaid, Medicare, or Children’s Health Insurance Program audit or evaluation.
*We would like to thank Purvi B. Maniar (Epstein Becker & Green PC, New York, NY) and Lesley R. Yeung (Epstein Becker & Green PC, Washington, DC) for authoring this email alert. We also would like to thank Suzette E. Gordon (Bronx Partners for Healthy Communities, New York, NY) for reviewing this email alert.