/>iOn January 18, 2017, the Substance Abuse and Mental Health Services Administration (SAMHSA) released its long-awaited final rule amending the confidentiality regulations at 42 CFR Part 2 (Part 2) that apply to federally assisted substance use disorder treatment programs (Part 2 Programs). SAMHSA concurrently issued a supplemental notice of proposed rulemaking (SNPRM) to further modify the regulation in light of commenter feedback, with a comment period ending February 17, 2017.
Part 2 has not been modernized in nearly 30 years. Since the last modification of Part 2 in 1987, the health data sharing landscape has changed dramatically as has the public and medical community’s understanding of and attitudes towards individuals with substance use disorders. As a result, Part 2 provisions designed to protect patients from stigma and other privacy concerns may have the unintended consequence of making it more difficult for providers to deploy data-driven tools and outreach to help these patients. In addition, since Part 2 was last modified, state and federal regulators have adopted other privacy frameworks, leaving providers with an array of overlapping and sometimes conflicting requirements.
Against this backdrop, SAMHSA stated that its goal in this rulemaking cycle was to reduce compliance burdens associated with Part 2 by making it easier for Part 2 Programs to exchange records and patient identifying information covered by Part 2 (Part 2 Records) with a patient’s treating health care providers through clinically integrated care networks, health information exchanges (HIEs) and accountable care organizations (ACOs). Notwithstanding that goal, SAMHSA acknowledged that further alignment with Health Insurance Portability and Accountability Act of 1996 (HIPAA) beyond those set forth in the final rule likely cannot occur without legislation from US Congress.
In addition, SAMHSA acknowledged that health care providers, clinically integrated care networks, HIEs and ACOs may incur significant costs to facilitate data sharing in light of the final rule’s corresponding consent requirements. SAMHSA estimates that the regulation will cost the industry $241 million dollars over the next 10 years. Thus, while the final rule is a step toward modernizing Part 2, and does reduce some burdens on the exchange of Part 2 Records, Congress will likely need to amend the statute authorizing Part 2 if it wants to advance efforts to harmonize Part 2 with the protections in place for other types of health information.
The following sections discuss the key changes included in the final rule and the SNPRM.
New General Designation Pathway
Part 2 applies to (1) patient identifying information (2) that has been obtained from a Part 2 Program and (3) indicates that the individual has a substance use disorder. Part 2 Programs and health care providers that receive Part 2 Records must obtain a patient’s written consent to share Part 2 Records for treatment, payment and health care operations purposes. In addition, Part 2 generally requires that the written consent form specify, among other things, the name or title of the individual or the name of the organization to which the disclosure is to be made. As a result of this specificity requirement, historically patients could not sign a general consent form permitting Part 2 Programs and others to share Part 2 Records with anyone involved in their care. Conversely, the HIPAA Privacy Rule permits authorizations to describe a class of recipients and does not require each recipient to be named.
Additionally, Part 2 Programs could not share Part 2 Records with other health care providers and payers for important health care operations such as care coordination, case management and population health activities unless they first obtain consent. The Privacy Rule permits such disclosures without patient authorization.
Making only minor changes from its proposed rule, SAMHSA finalized a new general designation consent pathway that permits Part 2 Programs and other lawful recipients of Part 2 Records to disclose Part 2 Records to all of a patient’s past, present and/or future treating providers through third parties, such as clinically integrated care networks, HIEs and ACOs, without naming each treating provider. The consent form must list by name the third parties (such as a HIE, ACO or clinically integrated care network) that will facilitate the exchange of the Part 2 Records and generally permit such third part(ies) to redisclose Part 2 Records to all health care providers involved in the patient’s past, present and/or future care. To offer this “general designation” pathway, however, the third party would be required to both: have the technological capability to limit access to Part 2 Records to providers involved in the patient’s care (as instructed by the patient’s consent); and produce to the patient upon demand a “list of disclosures” showing the providers that have received access to the patient’s Part 2 Records.
This second requirement goes beyond the HIPAA Privacy Rule’s accounting of disclosures requirement, which does not currently require covered entities and business associates to keep an accounting of routine disclosures for treatment, payment or health care operations purposes. Notably, the Office for Civil Rights (OCR) has been unable to implement, due to technological limitations, a similar provision of the HITECH Act that requires OCR to amend the Privacy Rule’s accounting of disclosures provision to require HIPAA covered entities to account for (i.e., track) disclosures for treatment, payment and health care operations purposes made through an electronic health record system.
SAMHSA reiterated in the final rule that Part 2 Programs are not required to offer this new general designation pathway if they do not participate in health information exchange facilitated by third parties. Given the investment of resources likely needed to implement the rule’s requirement to track disclosures under general designations, many clinically integrated care networks, HIEs and ACOs may determine that they cannot implement the pathway, or can only do so after a sustained delay to develop such features.
Additional Updates: Qualified Service Organizations, Research & Claims Data
While the new consent pathway might be the most newsworthy change included in the final rule, other changes finalized by SAMHSA may offer relief to health care providers, payers and researchers seeking to review Part 2 Records to conduct research, improve care quality and manage population health outcomes.
Qualified Service Organizations
SAMHSA finalized an expanded definition for “Qualified Service Organization” to include “population health management.” This change clarifies that Part 2 Programs may engage an ACO, managed care organization or other contractor to perform population health management activities, such as the identification and monitoring of particular patients within the Part 2 Program’s patient population, to improve health outcomes. As a result of this change, Part 2 Programs may seek increased assistance from vendors to perform these activities on their behalf.
Relatedly, the SNPRM responds to commenters who expressed concern that Part 2 does not currently allow recipients of Part 2 Records, such as third party payers, to disclose the records to subcontractors and other vendors that perform administrative functions on their behalf. Under SAMHSA’s current interpretation of Part 2 and the final rule, non-Part 2 Program recipients of Part 2 Records cannot engage such downstream contractors as Qualified Service Organizations because, by definition, Qualified Service Organizations provide services directly to Part 2 Programs.
Under the SNPRM, persons and entities that receive Part 2 Records pursuant to a Part 2-compliant consent would be permitted to disclose the Part 2 Records to contractors, subcontractors and legal representatives for the purpose of carrying out 17 specific payment and health care operations activities, including utilization review and quality assessment and improvement activities. The parties would need to enter into a contract (similar to a business associate agreement under HIPAA) which fully binds the contractor to Part 2.
However, payers and other entities that receive Part 2 Records could not use this contract pathway to engage a contractor to perform treatment-related activities such as care coordination or case management because SAMHSA only included health care operations and payment activities in the 17 specific functions. Under the SNPRM, written consent from the patient would be needed for a Part 2 Record holder (other than the Part 2 Program) to perform treatment-related activities.
While this much-needed new pathway would permit critical activities that health care providers and payers typically engage in, a broader HIPAA-like business associate pathway that includes care coordination and case management would be needed to allow contractors to assist health care providers and health plans to engage patients, better coordinate care and improve outcomes.
Research
SAMHSA finalized proposed changes to make the research exception to the Part 2 consent requirement more consistent with the Privacy Rule and the Federal Policy for the Protection of Human Subjects (Common Rule). Under the revised research exception, Part 2 Programs and other lawful holders of Part 2 Records may disclose patient identifying information to a researcher who: obtains approval to conduct research of Part 2 Records from an institutional review board (IRB) or privacy board formed under the requirements of the Privacy Rule or the Common Rule; and agrees to be fully bound by Part 2 with respect to the Part 2 Records and resist in judicial proceedings any efforts to obtain access to such records unless provision of the records is required by law.
In the final rule, SAMHSA declined to finalize a restriction in the proposed rule that would have only permitted researchers to link Part 2 Records with data from federal data repositories. Researchers may now link Part 2 Records to other data repositories upon approval of the appropriate IRB or privacy board, provided that the repository agrees to be fully bound by Part 2. This change in the final rule will create new opportunities to conduct research on substance use disorders.
Medicare Claims Data
SAMHSA offered guidance in the final rule in response to concerns that CMS is currently withholding claims data relating to substance use disorder treatment from the claims data it typically provides to CMS-regulated ACOs due to Part 2’s restrictions. ACOs want access to substance use disorder claims data in order to offer their patients comprehensive treatment and to assist with fully informed patient engagement and quality improvement efforts. The omission of Part 2 data from the patient file could understandably lead to ineffective and/or incomplete management of a patient’s care. According to SAMHSA’s guidance, CMS may disclose patient identifying information to CMS-regulated ACOs without first obtaining written consent, but only for the purpose of facilitating audits or evaluation activities, such as “reviews of financial performance or the quality of health care services delivered, [which are] undertaken by the CMS regulated organization itself to review its own performance.” ACOs will now need to wait and see if CMS will change its current policy, and release substance use disorder claims data for these limited purposes. Thus, SAMHSA does not appear to be enabling CMS to provide the Part 2 Records to ACOs for the clinical and care coordination purposes they sought.
Implications for Value-Based Payment Programs
As Medicare and private payers and providers shift from fee for service to value-based payment models and alternative payment models, the pressures to use and exchange patient information for care coordination, patient engagement, population health management and research intensify. While the Part 2 final rule and SNPRM includes helpful changes for Part 2 Programs and others seeking to more efficiently use and disclose Part 2 Records for research, population health management and care coordination, it maintains restrictions that prevent the sharing of Part 2 Records when otherwise permissible under HIPAA.
As long as Part 2 Records remain separated out from other types of health information, substance use disorder patients may continue to lag behind other patients in their access to improved care coordination, case management and population health activities. Pressure is likely to increase on Congress to enable better harmonization of privacy laws.
In the recently passed 21st Century Cures Act, Congress requires SAMHSA to convene stakeholders within the next year to determine the final rule’s effect on patient care, health outcomes and patient privacy. This provision signals that Congress may be willing to act if stakeholders conclude the final rule does not allow them to share Part 2 Records as needed to improve patient care and health outcomes. Part 2 Programs, clinically integrated care networks, HIEs, ACOs and other stakeholders should therefore continue to make their voices heard to SAMHSA and on Capitol Hill if they would like to see changes to Part 2 that align it more closely with HIPAA’s use and disclosure pathways.
