On August 26, 2019, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued a Notice of Proposed Rule Making (NPRM) outlining revisions to the Confidentiality of Substance Use Disorder Patient Records (Part 2) regulations. The proposed rule in part reflects SAMHSA‘s efforts to facilitate and enhance coordination of care for substance use disorders (SUD) while still maintaining Part 2 confidentiality protections.
SAMHSA has also issued another proposed rulemaking specifically to provide clarification that a court may authorize disclosure of confidential communications when the disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, even if the extremely serious crime was not allegedly committed by the patient as previously provided by the 2017 Final Rule (82 FR 052).
The following analysis presents an overview of the key proposed changes to Part 2 and the implications for Part 2 programs as well as non-Part 2 providers.
Applicability and re-disclosure
Within the NPRM, SAMHSA seeks to clarify the confidentiality and restrictions on re-disclosure of SUD-related information collected by Part 2 programs and non-Part 2 providers. SAMHSA clarifies that a non-Part 2 provider’s inclusion of SUD information in such provider’s records does not subject that record to Part 2, even in cases where the SUD information may have originated from a discussion with a Part 2 provider or from the non-Part 2 provider’s review of the Part 2 record. The NPRM specifically states: “the intent of these proposed clarifications is to better facilitate coordination of care between non-Part 2 providers and Part 2 programs, and to resolve lingering confusion among non-Part 2 providers about when and how they can capture SUD patient care information in their own records, without fear of those records being subject to the confidentiality requirements of Part 2.” SAMHSA also seeks to clarify that the Part 2 restrictions on re-disclosure apply to the Part 2 record and not the SUD information that may be learned from such record and then incorporated by the non-Part 2 provider in her records generated during the course of treating the individual. The NPRM states: “the intent is to allow a non-Part 2 provider to receive SUD information about a patient from a Part 2 program, and then to engage in a treatment discussion with that patient, informed by that information, and then be able to create her own treatment records including SUD content, without the latter becoming covered by Part 2.”
SAMHSA also recommends that non-Part 2 providers “segregate” or “segment” patient records in order to differentiate information subject to Part 2’s confidentiality requirements and information gathered from a discussion with a Part 2 provider used or learned from the review of the Part 2 record, in conjunction with information learned or confirmed by the non-Part 2 provider in the course of treating a patient. The NPRM proposes to add a new subsection (d)(2)(ii) to § 2.12 to read: “Notwithstanding paragraph (2)(i)(C) of this section, a non-Part 2 treating provider may record information about a substance use disorder (SUD) and its treatment that identifies a patient. This is permitted and does not constitute a record that has been re-disclosed under Part 2, provided that any SUD records received from a Part 2 program or other lawful holder are segregated or segmented. The act of recording information about a SUD and its treatment does not by itself render a medical record which is created by a non-Part 2 treating provider subject to the restrictions of this Part 2.”
Consent requirements
The 2017 final rule (82 FR 052) for Part 2 made several changes to the consent requirements for disclosure of protected information in Part 2 records including amending the written consent requirements regarding identification of the individuals and entities to whom disclosures of protected information may be made. This change allowed the use of a general designation in the “to whom” section of the consent requirement to individuals or entities with a treating provider relationship to the disclosing patient. With limited exceptions, disclosures of protected information to other entities or individuals without a treating provider relationship still required providing a specific individual name who would receive the protected information. SAMHSA noted that this amendment led to patients with SUDs having difficulty authorizing the disclosure of their protected information to third parties for non-treatment purposes, such as trying to obtain social security benefits or obtaining housing in a local sober living or a halfway house program (e.g., if the patient did not have a specific individual name at a halfway house).
SAMHSA now proposes to allow patients to authorize the disclosure of their protected information to organizations that do not have a treating provider relationship with the patient without the need to identity a specific individual that will receive the information. For example, if a patient wants a Part 2 program to disclose certain information to the Social Security Administration for benefit purposes, under the proposed rule, the patient would only need to identify the agency on the “to whom” section of the consent form.
Notably, however, SAMHSA proposes to maintain the treatment provider relationship requirement if a recipient entity is an entity that facilitates the exchange of health information or a research institution in order to ensure that only entities with the need to know the protected information from Part 2 records receive it.
Disclosures permitted with written consent
In the 2018 final rule (83 FR 239) for Part 2, SAMHSA determined that disclosures by lawful holders to contractors, subcontractors, and legal representatives for the purpose of payment and health care operations activities are permitted with written consent. While SAMHSA included a list of possible payment and health care operations activities, it previously decided not include such list in the Part 2 regulations. Thereafter, SAMHSA noted that stakeholders expressed confusion on whether information from Part 2 records could be disclosed for certain activities if not explicitly identified in the regulatory text. SAMHSA now proposes to list out the payment and health care operations activities (e.g., billing, underwriting, third-party liability coverage, etc.) in the Part 2 regulations that were previously provided in the 2018 final rule preamble while also noting that adding this list to the regulations is intended to be illustrative rather than exhaustive. SAMHSA also reiterated the same point as made in the 2018 final rule that disclosure for payment and health care operations is not intended to cover care coordination or case management (unlike as seen with HIPAA, which includes such activities under “health care operations”).
Disclosures to central registries and PDMPs
SAMHSA proposes to allow non-opioid treatment program (OTP) providers that have a treating relationship to a patient to access the central registries (organizations that obtain information from withdrawal management or maintenance treatment programs) to inquire about the patient. SAMHSA recognizes that with the opioid epidemic it is a necessity for providers that work with patients with SUDs to have access to the information provided in central registries to prevent not only duplicate patient enrollment for OUD treatment but also to help non-OTP providers make informed decisions about appropriate treatments.
In regards to prescription drug monitoring programs (PDMPs), previous SAMHSA guidance informed OTP providers that they could not disclose patient identifying information to a PDMP unless an exception applied. SAMHSA has now determined that, based on the opioid crisis, the lack of OTP data from PDMPs can result in significant adverse events, as patients may receive either duplicate or possibly contraindicated prescriptions outside of any prescriptions provided by an OTP provider. Therefore, SAMHSA proposes to allow OTP providers and other lawful holders to report OTP prescription data to their respective state PDMPs. Part 2 providers would still be required to obtain written consent from the patient whose identifying information would be disclosed prior to any submission to the respective PDMP.
Research
SAMHSA also recommended changes to how research institutions access patient identifying information in SUD-related studies. Under Section 2.52, Part 2 providers may only disclose patient’s identifying information without patient consent if the research is conducted by a HIPAA covered entity or its business associate that (1) has obtained authorization from the patient, (2) holds a waiver or other authorization that is consistent with HIPAA Privacy Rule, or (3) is subject to the HHS regulations regarding the protection of human subjects under the Common Rule. As the number of patients receiving treatment for SUD and OUD continues to rise, SAMHSA found limiting access to specific research institutions ultimately restricts the advancement of treatment.
Under the new rule, SAMHSA proposes modifying Section 2.52 to allow Part 2 data to be disclosed to three types of research entities. First, patient identifying information may be disclosed to a HIPAA covered entity or a business associate that is neither a HIPAA covered entity nor subject to the Common Rule, as long as any such data will be disclosed in accordance with the HIPAA Privacy Rule. SAMHSA will also allow research disclosures to members of the workforce of HIPAA covered entities for employer-sponsored research that requires all research activities to meet the requirements of either the Privacy Rule and/or the Common Rule. Last, patient identifying information may be disclosed to entities governed by the Federal Drug Administration’s regulations for the protection of human subjects in clinical investigations.
Audit and evaluation
To address perceived confusion as to permissible disclosures for audits and evaluations, as well as to align the Part 2 regulations with those governing quality improvement organizations, SAMHSA proposes rule updates regarding disclosures for audits and evaluations. Acknowledging that the Part 2 regulations do not define audits and evaluations, SAMHSA clarifies that these concepts are not limited to reviews that analyze the performance of individual Part 2 programs. Audits or evaluations may be tools to determine if changes need to be made at an agency or payor level. In the NPRM, SAMHSA encourages Part 2 programs to disclose de-identified information, but acknowledges that this may not always be feasible or economical. The NPRM specifies that Part 2 programs may disclose records to government agencies and third-party payors for audit and evaluation purposes, including for identifying actions necessary to improve treatment and outcomes for Part 2 patients, and that records may be disclosed to government agencies and their contractors for audits or evaluations mandated by law. It also clarifies that an auditor may be a party that has administrative control over the Part 2 program with respect to audits and evaluations of the program.
Undercover agents and informants
To combat any illicit sale or transfer of drugs by medical personnel, the Part 2 regulations currently permit the placement of undercover agents and informants within Part 2 programs, limited to a period of six months. Following input from the U.S. Department of Justice, SAMHSA believes that this six-month cap is overly restrictive, as investigations can last for longer periods. The NPRM proposes allowing court-ordered placement of an undercover agent or informant within a Part 2 program for a period of up to 12 months starting from the date that the agent is placed in the program, or the date the informant is identified. Courts may further extend the period of placement through a new court order.
Public comments
For the NPRM for all but the proposed change addressed below, stakeholders will have until October 25, 2019, to submit their comments. For the NPRM regarding clarification for when courts may authorize disclosure of confidential communications, stakeholders will have until September 25, 2019, to submit their comments.