HHS and SAMHSA Issue Proposed Rule to Ease Coordination of Care for Patients with Substance Use Disorders

September 2019 ~

On August 26, the Department of Health and Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) issued a proposed rule amending the regulations governing the Confidentiality of Substance Use Disorder Patient Records (SUD) records (Part 2).

Initially implemented in 1975, the Part 2 regulations were designed to protect the confidentiality of SUD patient records created by certain federally-funded programs. The regulations were updated in 2017 and 2018 to help facilitate information exchange among treating providers while addressing the legitimate privacy concerns of patients seeking treatment for a SUD.

Despite those changes, there has been some concern from covered programs and treating providers over the restrictive nature of the regulations and the difficulties in disclosing patient information among treating providers.

In response to this concern, SAMHSA says its intent is to aid in facilitating coordinated care while continuing to provide patients of Part 2 Programs appropriate privacy protections. According to the agencies, if finalized, the proposed rule will bring some relief to non-Part 2 providers who may have been reluctant in the past to document information relating to SUDs, and will afford greater clarity to Part 2 providers and other lawful holders of patient identifying information on permitted uses and consent requirements.

The Proposed Rule includes the following changes:

Applicability & Re-disclosure

In an effort to facilitate coordination of care activities by non-part 2 providers, treatment records created by non-part 2 providers based on their own patient encounter(s) will not be covered by part 2, unless any SUD records previously received from a part 2 program are incorporated into such records. Segmentation or holding a part of any part 2 patient record previously received can be used to ensure that new records created by non-part 2 providers will not become subject to part 2.

Disposition of Records

Under the proposal, when an SUD patient sends an incidental message to the personal device of an employee of a part 2 program, the employee will be able to fulfill the part 2 requirement for “sanitizing” the device by deleting that message. This change is aimed at ensuring that the personal devices of employees will not need to be confiscated or destroyed, in order to sanitize per part 2.

Consent Requirements

Under the proposed rule, an SUD patient may consent to disclosure of his part 2 treatment records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure. This change is intended to allow patients to apply for benefits and resources more easily, for example, when using online applications that do not identify a specific person as the recipient for a disclosure of part 2 records.

Disclosures Permitted with Written Consent

Disclosures for the purpose of “payment and health care operations” are permitted with written consent, in connection with an illustrative list of 17 example activities. According to HHS, In order to resolve lingering confusion under part 2 about what activities count as “payment and health care operations,” the list of examples will be moved into the regular text from the preamble.

Disclosures to Prevent Multiple Enrollments & Disclosures to Prescription Drug Monitoring Programs

Under the proposed rule, non-OTP providers will become eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program. OTPs will be permitted to enroll in a state prescription drug monitoring program (PDMP), and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.

HHS states the revised central registry and PDMP provisions will help to prevent duplicative enrollments in SUD care, duplicative prescriptions for SUD treatment, and adverse drug events related to SUD treatment.

Medical Emergencies

To ensure clinically appropriate communications and access to SUD care, in the context of declared emergencies resulting from natural disasters, it has been proposed that declared emergencies resulting from natural disasters (e.g., hurricanes) that disrupt treatment facilities and services will meet the definition for a “bona fide medical emergency,” for the purpose of disclosing SUD records without patient consent under part 2.

Research

To facilitate appropriate disclosures for research, by streamlining overlapping requirements under part 2, the Privacy Rule and the Common Rule, the proposal seeks disclosures for research under part 2 will be permitted by a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule (re: Research on Human Subjects).

 Audit and Evaluation

Part 2 will be revised to clarify that some specific situations fall within the scope of permitted disclosures for audits and/or program evaluation. This change is intended to resolve current ambiguity under part 2 about what activities are covered by the audit and evaluation provision.

Orders Authorizing the Use of Undercover Agents and Informants

In an effort to address DOJ concerns that the current policy is overly restrictive to some ongoing investigations of part 2 programs, the proposed rule calls for court-ordered placement of an undercover agent or informant within a part 2 program will be extended to a period of 12 months, and courts will be authorized to further extend the period of placement through a new court order.

HHS notes that the proposed rule will not alter the basic framework for confidentiality protection of SUD patient records created by federally funded treatment programs. Part 2 will continue to prohibit law enforcement use of SUD patient records in criminal prosecution against the patient. Part 2 will also continue to restrict the disclosure of SUD treatment records without patient consent, other than as statutorily authorized in the context of a bona fide medical emergency; or for the purpose of scientific research, audit, or program evaluation; or based on an appropriate court order for good cause.

Comments on the proposed rule are due by October 25, 2019. For more information, read the HHS 42 CFR Part 2 Proposed Rule Fact Sheet.

Source(s): Federal Register; U.S. Department of Health & Human Services; Lexology; Crowell Moring; Proskauer; JD Supra; Open Minds; HIPAA Journal; C&M Health Law; Baird Holm;