SAMHSA has released a long-awaited proposed rule that would modify the federal regulations at 42 CFR Part 2 (Part 2) governing the confidentiality of substance use disorder (SUD) patient records created by federally assisted SUD treatment programs. The Proposed Rule includes several provisions aimed at reducing barriers to the coordination of care for SUD patients between Part 2 programs and non-Part 2 providers. However, HHS has called for further congressional action to remove additional statutory barriers to better aligning Part 2 with the HIPAA Privacy Rule.

IN DEPTH

On August 26, 2019, the Substance Abuse and Mental Health Services Administration (SAMHSA) published a long-awaited proposed rule (Proposed Rule) in the Federal Registerthat would modify the federal regulations at 42 CFR Part 2 (Part 2) governing the confidentiality of substance use disorder (SUD) patient records (Part 2 Records) created by certain federally assisted SUDs programs (Part 2 Programs). The Proposed Rule is the first of four regulations that the US Department of Health and Human Services (HHS) plans to release as part of its Regulatory Sprint to Coordinated Care.

In the Proposed Rule, SAMHSA seeks to eliminate barriers to care coordination among Part 2 Programs and other health care providers, particularly in today’s health care delivery system, which increasingly aims to reward providers for effectively managing patient care across multiple care settings and penalize providers who fail to do so. Part 2 currently requires health care providers and health plans to develop strategies to remove SUD treatment information from records before sharing them with other providers or care coordinators or implement complicated processes for obtaining patients’ consent to share the records.

The Proposed Rule seeks to achieve a “balance of policy interests” by minimizing Part 2’s disruptions to providers’ ability to share records to care for patients with SUDs, while still respecting the privacy concerns of patients seeking treatment who may be concerned about the social stigma of SUDs.

Under the Proposed Rule, Part 2 Programs and recipients of records created by Part 2 Programs (Lawful Holders) would generally remain subject to Part 2’s limitations on using and disclosing Part 2 Records. SAMHSA did not propose further modifications to Part 2 because SAMHSA concluded it did not have the needed flexibility under the Public Health Services Act, the federal statute that authorizes Part 2. When HHS Secretary Alex Azar announced the Proposed Rule, he requested that Congress consider legislation to amend the statute to allow SAMHSA to bring Part 2 into closer alignment with the patient privacy protections of the less stringent HIPAA Privacy Rule. The Privacy Rule does not preempt requirements of state and federal privacy laws, like Part 2, that are more protective of an individual’s privacy. Proposed legislation that would address Secretary Azar’s request has been introduced in Congress and is discussed below.

Comments on the Proposed Rule are due on October 25, 2019.

We address the following topics below:

• Proposed modifications to the scope of records covered by Part 2

• Proposed changes to the Part 2 consent requirement

• Proposed changes to remove barriers to research involving Part 2 patient identifying information

• Proposed changes to facilitate disclosures to prescription drug monitoring programs and centralized registries

• Congressional proposals to align Part 2 and HIPAA

• Next steps for industry stakeholders

Proposed modifications to scope of records covered by Part 2

Although Part 2 only applies to Part 2 Records created by a Part 2 Program, a Lawful Holder of Part 2 Records is also prohibited from re-disclosing the Part 2 Records unless the Lawful Holder has obtained the patient’s consent. In a final rule amending Part 2 in 2018, SAMHSA clarified that Lawful Holders could re-disclose Part 2 Records to downstream agents, subcontractors and legal representatives that are assisting the Lawful Holder to carry out uses of the Part 2 Records if permitted under the scope of the original consent. Otherwise, however, Part 2 generally requires Lawful Holders to obtain consent for any re-disclosure of Part 2 Records to a subcontractor or other third party. The requirement to obtain consent for re-disclosure has caused many industry stakeholders to conclude that Part 2 impairs care coordination efforts among health care providers to the potential detriment of Part 2 patients’ health.

The primary objective of the Proposed Rule is to clarify the extent to which health care providers that do not operate Part 2 Programs are subject to Part 2 requirements, and eliminate confusion as to the applicability of Part 2 to SUD information held by such non-Part 2 providers. The Proposed Rule would amend Part 2 to clarify that information that a non-Part 2 provider records in writing about a patient’s SUD or SUD treatment is not automatically a Part 2 Record to which Part 2’s re-disclosure prohibitions apply, so long as the non-Part 2 provider segregates Part 2 Records the provider maintains from other SUD information that the provider records in non-Part 2 records (e.g., general medical records).

The Proposed Rule would accomplish this by amending the definition of “records” to provide that “information conveyed orally by a part 2 program to a non-part 2 provider for treatment purposes with the consent of the patient does not become a record subject to [part 2]…merely because that information is reduced to writing by that non-part 2 provider.”

The Proposed Rule would also update Part 2’s applicability section to emphasize that the “act of recording information about a substance use disorder and its treatment does not by itself render a medical record which is created by a non-part 2 treating provider subject to the restrictions of this part 2.” SAMHSA anticipates that these proposed amendments will facilitate coordination of care for patients with SUDs by encouraging non-Part 2 providers to more freely document SUD information in medical records without the concern that those records will become subject to Part 2’s consent requirements and re-disclosure restrictions. The Proposed Rule would also potentially eliminate the need to separate SUD-related diagnosis, medication or laboratory result information from non-Part 2 medical records before sharing the information with other health care providers. Instead, non-Part 2 providers would only need to segregate copies of Part 2 Records received from Part 2 Programs.

Notably, the Proposed Rule only discusses records retained by non-Part 2 providers and not other Lawful Holders. Health plans, for example, receive information from Part 2 Records in the form of insurance claims from Part 2 Programs and then create their own records when they process and pay the claim (e.g., claim adjudication records or remittance advice issued to providers). The Proposed Rule’s clarification does not address whether Part 2 applies to records created by Part 2 patients’ health plans. Health plans and other payer entities should consider whether to submit comments to SAMHSA requesting clarification of how the Proposed Rule impacts records created as part of the billing and payment process for Part 2 Program services, including the HIPAA-standardized electronic claim and remittance advice transactions.

Proposed Changes to the Part 2 Consent Requirement

The Proposed Rule would make the following changes to Part 2’s requirement to obtain consent for most disclosures or re-disclosures of Part 2 records.

Ability to Designate Entity as Recipient under Part 2 Consent

Currently, Part 2 Programs and Lawful Holders must obtain a consent that identifies the specific name of the individual to whom a Part 2 Program or Lawful Holder may disclose the Part 2 Records rather than the name of the recipient’s corporation or other legal entity, unless the recipient is a treating provider or a third-party payer. Under the Proposed Rule, Part 2 Programs and Lawful Holders would be permitted to obtain a consent that identifies the name of the individuals or entities for all categories of recipients. SAMHSA explained that this change, if finalized, would make it easier for patients that are seeking a disability determination, participating in a deferred prosecution program, such as a drug court, or seeking to participate in case management programs offered by third-party payers to generally consent to the disclosure of their Part 2 Records to the agencies or organizations receiving the Part 2 Records rather than specific individuals within those agencies or organizations.

Re-Disclosures by Lawful Holder under Original Consent

As noted above, SAMHSA modified Part 2’s consent requirements in its 2018 final rule to permit a Lawful Holder to re-disclose Part 2 Records to agents, subcontractors and legal representatives for payment and health care operations purposes (but not treatment purposes) that are consistent with the stated purpose of the original consent under which the Part 2 Program disclosed Part 2 Records to the Lawful Holder. In the 2018 final rule preamble, SAMHSA listed 17 examples of payment and health care operations activities that would be permissible for re-disclosures by Lawful Holders to subcontractors without an additional patient consent. The 17 examples mostly align with the HIPAA Privacy Rule’s definitions of “payment” and “health care operations.” For example, if a Part 2 Program disclosed Part 2 Records to a third-party payer as part of a claim for payment pursuant to a consent for billing purposes, the third-party payer could re-disclose the Part 2 Records without an additional patient consent to a subcontractor that assists the third-party payer to process the claim.

Under the Proposed Rule, SAMHSA does not propose to modify the 17 examples of payment and health care operations purposes listed in its 2018 preamble guidance, but instead proposes to move the examples into the Part 2 regulatory text to clarify that: (1) Lawful Holders may disclose Part 2 Records to subcontractors for the purposes noted in the 17 examples; and (2) the 17 examples are meant to be illustrative and not exhaustive.

Although SAMHSA’s movement of the 17 examples to the Part 2 regulatory text may clarify that Lawful Holders can subcontract certain payment and health care operations involving Part 2 Records within the scope of the patient’s original consent, the Proposed Rule did not provide guidance on the steps that Lawful Holders (who in many cases do not have access to the consent form used by the Part 2 Program to obtain consent for the disclosure) must take to ensure the purposes stated in the original consent are sufficient to permit subcontracting.

Re-Disclosures for Case Management and Care Coordination

Although the 17 examples mostly align with the HIPAA Privacy Rule’s definitions of payment and health care operations, SAMHSA states (consistent with its 2018 final rule preamble guidance) that it considers case management and care coordination to be treatment and not health care operations (even though the Privacy Rule includes the activities within both definitions). Consequently, third-party payers that are Lawful Holders cannot re-disclose Part 2 Records to third-party case managers or care coordinators under the original billing consent obtained by the Part 2 Program.

Third-party payers rely on case management and care coordination to coordinate their members’ care, promote adherence to treatment and control costs. Care coordination and case management are potentially beneficial to SUD patients since they often have complex cases involving behavioral health co-morbidities and are susceptible to non-adherence to prescribed treatments. Without the original consent pathway, third-party payers must obtain a consent from their members before they disclose Part 2 Records to case managers and care coordinators—a barrier that does not exist under the HIPAA Privacy Rule. Third-party payers and their care coordination subcontractors should consider submitting comments to the Proposed Rule asking SAMHSA to reconsider its determination that case management and care coordination are treatment activity rather than health coaching or other legitimate plan health care operations activities under modern payment methodologies.

Proposed Changes to Remove Barriers to Research Involving Part 2 Patient Identifying Information

Currently, Part 2 Programs may only disclose Part 2 patient identifying information for research without consent if the recipient of the information is a HIPAA covered entity or business associate, or is subject to the Federal Policy for the Protection of Human Subjects (Common Rule). Researchers that are not subject to HIPAA or the Common Rule, such as state agencies or professional associations, may only receive Part 2 patient identifying information for research pursuant to patient consent. Consequently, Part 2’s current research exception prevents such researchers from performing retrospective data studies that would typically qualify for a waiver of the HIPAA Privacy Rule’s authorization requirement and the Common Rule’s consent requirement. The Privacy Rule permits a covered entity to disclose protected health information to any researcher if the covered entity has obtained a waiver from an institutional review board or privacy board, even if the researcher is not a HIPAA covered entity or business associate.

Under the Proposed Rule, Part 2 Programs (and Lawful Holders) that are covered entities or business associates under HIPAA could disclose Part 2 Records for research purposes in accordance with HIPAA’s disclosure pathways for research. Additionally, the Proposed Rule would permit Part 2 Programs (and Lawful Holders) to disclose Part 2 Records to researchers who are subject to Food and Drug Administration regulations on human subject research. These proposed provisions would allow Part 2 Programs and Lawful Holders to disclose Part 2 Records to a greater number of researchers and harmonize Part 2 with other HHS authorities regulating clinical research.

Disclosures to Prescription Drug Monitoring Programs and Centralized Registries

Part 2 does not currently permit opioid treatment programs (i.e., health care providers that provide medication-assisted treatment, such as methadone clinics) to report methadone or buprenorphine dispensing information to state prescription drug monitoring programs (PDMPs), which gather pharmacy dispensing data to help prescribers and pharmacies prevent overdoses and detect excessive prescribing and dispensing. Recognizing that including opioid treatment program data in PDMPs could help prevent opioid overdoses, SAMHSA proposes to permit opioid treatment programs to disclose Part 2 Records concerning patient treatment in the program to PDMPs with the consent of the patient.

Although Part 2 does not currently permit opioid treatment programs to disclose dispensing information to a PDMP, opioid treatment programs are permitted to contribute patient enrollment information to certain centralized registries aimed at preventing multiple enrollments in different programs. However, currently only opioid treatment programs may query the data from these centralized registries. The Proposed Rule would modify this provision to allow any health care provider with a treating provider relationship with a patient to query opioid treatment program centralized registries to determine whether the patient is already receiving medication-assisted treatment prior to referring them to another opioid treatment program.

Congressional Proposals to Align Part 2 and HIPAA

Like HHS, members of Congress recognize the need for changes to Part 2 to facilitate coordination of care and adapt it to the modern health care delivery system. Accordingly, legislation has been proposed to better align Part 2 with the HIPAA Privacy Rule.

Senators Manchin (D-WV) and Capito (D-WV) in the Senate, and Reps. Blumenauer (D-OR) and Mullin (R-OK) in the House, reintroduced legislation that seeks to align Part 2 with the HIPAA Privacy Rule, allowing Part 2 providers to disclose Part 2 Records to HIPAA covered entities for treatment, payment and health care operations purposes without first obtaining written patient consent. The proposed legislation, titled the Overdose Prevention and Patient Safety Act in the House and the Protecting Jessica Grubb’s Legacy Act in the Senate, would otherwise maintain special confidentiality protections for Part 2 Records, including a prohibition on using the Part 2 Records in criminal, civil or administrative proceedings without a court order or the patient’s written consent. A similar bill passed the House last year on a bipartisan basis as part of the SUPPORT Act (on a 357-57 vote), but was removed by the Senate prior to passage. Two leading Republicans on the House Energy and Commerce Committee, Congressman Greg Walden (R-OR) and Michael Burgess (R-TX), issued a press release following SAMHSA’s publication of the Proposed Rule advocating for Congress to pass the Overdose Prevention and Patient Safety Act.

Next Steps

If finalized, the Proposed Rule is likely to help non-Part 2 providers and other Lawful Holders in specific situations. Non-Part 2 providers will likely benefit from being able to separately document SUD diagnoses in their own medical records without such records becoming subject to Part 2. Third-party payers may benefit by being able to seek consent from members to disclose Part 2 Records to a care coordination entity rather than individual employees of the entity.

However, there are several areas of the Proposed Rule that are ripe for comment and further clarification from SAMHSA—such as the ability of health plans and other Lawful Holders who are not health care providers to create separate records containing SUD information that would not be subject to Part 2. Stakeholders impacted by the Proposed Rule should consider submitting comments to SAMHSA by October 25, 2019.