On Tuesday, February 9, the Substance Abuse and Mental Health Services Administration (SAMHSA) published a proposed rule to update regulations at 42 C.F.R. Part 2 that protect the confidentiality of alcohol and drug abuse patient records.  The regulations were originally promulgated in 1975 and last substantively updated in 1987.  SAMHSA intends for these updates to better align the regulations with advances in the U.S. health care delivery system, such as health information technology.

Background

The regulations at 42 C.F.R. Part 2 (“Part 2 regulations”) protect the confidentiality of patient records that are maintained in connection with the performance of any federally assisted program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research.

The goal of the regulations is to ensure that individuals are not deterred from seeking treatment for substance abuse disorders out of concern about the potential disclosures of these records.  SAMHSA notes that unauthorized disclosure has the potential for significant negative consequences for patients, such as: loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration.

To safeguard substance abuse treatment records, Part 2 regulations require that a patient consent to the disclosure of individually identifiable information related to diagnoses, treatment, or referrals by federally assisted substance abuse programs, except in certain limited circumstances, such as a bona fide medical emergency, for research purposes, for audit and evaluation activities, and pursuant to a court order.

SAMHSA proposes the following changes to the regulations:

Scope of Part 2 Regulations

The proposed regulations would clarify that the regulations apply to “part 2 programs.” SAMHSA proposes to revise the definition of “program” to make clear that the definition would not include general medical facilities and general medical practices; however (a) an identified unit within a general medical facility that holds itself out as providing substance abuse treatment, as well as (b) medical staff within a general medical facility whose primary function is the provision of substance abuse treatment, would be subject to the regulations. A part 2 program would mean a federally assisted program subject to the regulations, including Medicaid and Medicare as well as any other program, outside the Veterans Administration and Armed Forces, that receives some sort of federal financial assistance, even if the federal funds are not used to provide treatment for substance abuse disoreders.

Furthermore, SAMHSA proposes to replace the terms “alcohol abuse” and “drug abuse” with the more general term “substance abuse disorder.” SAMHSA proposes to define a “substance abuse disorder” as any disorder that can be associated with an altered mental state that has the potential to lead to risky and/or socially prohibited behaviors.  SAMHSA clarifies that this definition would exclude abuse of tobacco and caffeine.

Consistent with the goal to “modernize” Part 2 regulations, SAMHSA proposes to make clear that the regulations apply to electronic records.  Similarly, SAMHSA explains that the term “written” as used in the regulation would mean both paper and electronic writings.

Facilitating Electronic Exchange of Patient Information

SAMHSA proposes to ease the restrictions on the requirements governing valid patient consent for  disclosure of records.  Under current rules, patients must specify the name or title of the individual or name of the organization to whom the disclosure will be made.  Under the new proposed rules, a patient would be able to give a general designation of the entity to whom the information would be disclosed, as long as those entities have a treatment relationship with the patient (e.g., “all treating providers”).  SAMHSA would define such a relationship to include when an individual seeks health-related assistance, regardless of whether there has been an in-person encounter with the patient.  This would obviate the need to obtain a separate consent for each separate disclosure.

SAMHSA explains that this change would facilitate disclosures by providers to a health information exchange, per the patient’s consent, if the patient designates the name of the exchange in the consent form along with the category of treating providers who will receive the information through the exchange.   SAMHSA hopes that federally assisted substance abuse programs will take advantage of the many new integrated care models that rely on interoperable health IT and that these proposed changes would support the integration of substance use disorder treatment into these models.

However, to balance the easing of the patient consent requirements, SAMHSA proposes additional safeguards to protect patient confidentiality.

• While patients could give a more general description of the entities to whom the information be disclosed, patients would also be entitled to an accounting of individuals and entities to whom the information was disclosed pursuant to this general designation.

• The proposed rule would require individuals to identify, with greater specificity, the amount and kind of information to be disclosed. SAMHSA explains patients should be aware of the specific information they are authorizing to disclose, given its proposal to allow a wider distribution of recipients with one form.

• SAMHSA also would require that the consent form include a statement that the patient understands the terms of the consent along with a statement that the patient understands his or her rights to request an accounting of entities to whom the information has been disclosed.

Redisclosure Prohibition Does Not Apply to General Health Information

Currently, each disclosure made pursuant to patient consent must be accompanied by a written statement that federal law prohibits the disclosure of the information.

SAMHSA proposes to clarify this written statement to specify that federal law prohibits the redisclosure of information “that identifies a patient as having or having had a substance abuse disorder either directly, by reference to publicly available information, or through verification of such identification by another person.” SAMHSA explains that the regulation does not prohibit a provider from disclosing more general health care information (e.g., high blood pressure) that is not connected to the substance abuse disorder.  This becomes somewhat complicated for comorbid disorders.  For example, SAMHSA clarifies that disclosures about illnesses brought about by substance abuse that may reveal the substance abuse disorder (e.g., cirrhosis of the liver) would be prohibited without patient consent.

Expanding the Scope of Bona Fide Medical Emergency

Part 2 regulations permit patient identifying information to be disclosed to medical personnel for a bona fide medical emergency, defined by current regulations to mean treating a condition which poses an immediate threat to the health of any individual and requires immediate medical intervention.  SAMHSA proposes to revise the regulation to give more discretion to medical personnel to determine what is a bona fide medical emergency in situations where it is impossible to obtain the patient’s consent.

Allowing Use of Federal Data Repositories

SAMHSA proposes several changes to the provision that permits disclosure of identifying information for research purposes.  The proposed regulation would require that, prior to such a research disclosure, the part 2 program’s director, managing director, or individual otherwise vested with such authority determine that the recipient of the information is (a) either a HIPAA covered entity and has obtained a waiver of authorization in accordance with HIPAA, and/or (b) is subject to the HHS Common Rule.

SAMHSA also proposes to permit data linkages to federal data repositories, under which researchers both may disclose and receive patient identifying information from the repository.  SAMHSA solicits input regarding whether to expand data linkages beyond federal data repositories and how to ensure that data repositories providing data linkages are in compliance with criteria or standards concerning confidentiality, privacy and security safeguards.

SAMHSA also proposes to require any individual or entity using patient identifying information for scientific research to fully comply with the requirements in Part 2, including that it must resist any efforts by others to obtain these records in judicial proceedings, except as permitted by the Part 2 regulations (e.g., in response to a court order).

Comments on the proposed rule are due by April 11, 2016.