The Department of Health and Human Services has published its final rule on the Confidentiality of Substance Use Disorder Patient Records. This rule brings significant and much-needed changes to Substance Abuse and Mental Health Services Administration (SAMHSA) regulations, which has remained largely unchanged since 1987.
The update was issued such that regulations are more in line with advances in healthcare delivery in the United States, while ensuring patient’s privacy is protected when they are being treated for substance abuse disorders. The HSS’s final rule addresses the permitted uses and disclosures of patient identifying information for healthcare operations, payment, audits and evaluations.
It has been three decades since the last significant changes made to the Confidentiality of Alcohol and Drug Abuse Patient Records (42 CFR part 2) regulations. In 2016, SAMHSA submitted a Notice of Proposed Rulemaking in the Federal Register proposing updates to 42 CFR part 2. The proposed updates considered the development of integrated health care models and the use of electronic exchange of patient information. The updates were designed such that patient privacy was protected to prevent improper disclosures of protected health information (PHI).
While creating the rule, SAMHSA considered public comments on the issue. In January 2017, a final rule was published. The new rule incorporated greater flexibility for disclosures within the healthcare system while still continuing to protect the confidentiality of substance use disorder records.
In addition to the final rule, a supplemental notice of proposed rulemaking was also issued. SAMHSA sought public comments on the additional proposals, which covered disclosures related to payment and healthcare operations that can be made to contractors, subcontractors, and legal representatives by lawful holders under the part 2 rule consent provisions, and disclosures for purposes of carrying out Medicaid, Medicare or Children’s Health Insurance Program (CHIP) audits or evaluations.
SAMHSA received 55 comments on the issue. In crafting its proposed revisions, it considered the public concerns on the issue at hand. Several of the commenters sought better alignment with the Health Insurance Portability and Accountability Act (HIPAA) and/or the Health Information Technology for Economic and Clinical Health (HITECH) Act. The commenters said such an alignment would promote better information flow between relevant parties, while providing greater discretion for providers and administrators of services.
SAMHSA has attempted to align the revisions with HIPAA and the HITECH Act as far as is possible, but explained, “It is important to note that part 2 and its authorizing statute are separate and distinct from HIPAA, the HITECH Act, and their implementing regulations.”
“Part 2 provides more stringent federal protections than other health privacy laws such as HIPAA and seeks to protect individuals with substance use disorders who could be subject to discrimination and legal consequences in the event that their information is improperly used or disclosed.”
Comments were received suggesting SAMHSA should make it easier for healthcare providers using alternative payment models to share records, as the lack of information about substance abuse disorders could negatively affect patient care.
The commenters appeared to disagree about whether care coordination and case management should be included in the list of permissible activities under payment and health care operations. Possibly due to this lack of general consensus, SAMHSA has decided not to include care coordination and case management and the list of permissible activities that SAMHSA considers to be payment and health care operations, and the list is ‘substantively unchanged.’
In the final rule, SAMHSA has included language in the regulatory text that clarifies disclosures to contractors, subcontractors and legal representatives are not permitted for activities related to a patient’s diagnosis, treatment, or referral for treatment.
SAMHSA will continue to review all of the issues raised in the comments and will explore ways to better align Part 2 with HIPAA and HITECH, including future additional rulemaking for 42 CFR part 2.
A public meeting will also be held prior to March 21, 2018, to determine the effects of 42 CFR part 2 on patient care, health outcomes, and patient privacy. Stakeholders will be given the opportunity to provide input on implementation of part 2, including the changes adopted in the final rule.