Update to Substance Abuse Treatment Records Regulations

By: Adjunct Professor in the Master of Science in Health Law and Policy Program at Cumberland School of Law

On January 13, 2017, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued its Final Rule to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (42 CFR Part 2), often referred to as “Part 2”.

It has been nearly 30 years since Part 2 was last updated. In that time, the provision of healthcare has drastically changed and the substance abuse treatment records regulations were past due for an overhaul. Under the existing Part 2, substance use disorder programs generally may only release patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment with an individual’s express consent. Even disclosures related to payment, treatment, or health care operations, which are permissible under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) without patient authorization, require express consent.

According to SAMHSA, the Final Rule will further enhance health services research, integrated treatment, quality assurance and health information exchange activities while at the same time safeguarding the essential privacy rights of people seeking treatment for substance use disorders.

Following issuance of the Final Rule, Part 2 continues to apply to any substance use disorder program that receives federal financial assistance, including reimbursements from Medicare, Medicaid, and other government programs, and holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment (Part 2 Program). Patient records subject to Part 2, however, now include substance use disorder records maintained by Part 2 Programs, as well as those records in the possession of “other lawful holders of patient identifying information” (e.g., individual or entities who receive such records pursuant to a Part 2-compliant patient consent).

Major provisions of the Final Rule effective February 17, 2017, include the following:

• Permits a patient, in certain circumstances, to include a general designation in the “To Whom” section of the consent form (e.g., “my treating providers”), in conjunction with requirements that the consent form include an explicit description of the amount and kind of substance use disorder treatment information that may be disclosed.

• Permits electronic signatures to the extent that they are not prohibited by any applicable law.

• Adds a requirement that, upon request, patients who have included a general designation in the “To Whom” section of their consent form must be provided a list of entities (referred to as a List of Disclosures) to which their information has been disclosed pursuant to the general designation.

• Requires both Part 2 Programs and other lawful holders of patient identifying information to have in place formal policies and procedures addressing security, including sanitization of associated media, for both paper and electronic records.

• Regulations related to the disposition of records by discontinued Part 2 Programs now address both paper and electronic records, and adds requirements for sanitizing associated media.

• Clarifies that the required written summary of federal law and regulations to be provided to patients may now be in either paper or electronic format.

• Clarifies that the prohibition on re-disclosure only applies to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, such as indicated through standard medical codes, descriptive language, or both, and allows other health-related information shared by the Part 2 Program to be re-disclosed, if permissible under other applicable laws.

• Permits data protected by Part 2 to be disclosed to qualified personnel for the purpose of conducting scientific research by a Part 2 Program or any other individual or entity that is in lawful possession of Part 2 data if the researcher provides documentation of meeting certain requirements related to other existing protections for human research.

• Modernizes the audit and evaluation requirements to include provisions governing both paper and electronic patient records.

• Permits an audit or evaluation necessary to meet the requirements of a CMS-regulated accountable care organization or similar CMS-regulated organizations, under certain conditions.

Here are links to the Final Rule and the SAMHSA news release.

Many health care organizations have expressed concerns that the SAMHSA Final Rule does not go far enough. The Partnership to Amend 42 CFR Part 2, a coalition of over 20 health care organizations including the American Hospital Association and the National Association of State Mental Health Program Directors, was formed in an effort to align Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to allow appropriate access to patient information that is essential for providing whole-person care. In a press release issued January 13, 2017, the Chair for the Partnership to Amend 42 CFR Part 2 states:

While the final rule is a step in the right direction, it fails to adequately ensure that persons with substance use disorder receive the effective coordinated care they deserve. Particularly in light of our country’s opioid crisis, it is imperative that Part 2 requirements are aligned fully with the HIPAA requirements that allow the use and disclosure of patient information for treatment, payment, and health care operations. Failure to integrate care that addresses all of a patient’s health needs can lead to unintended risks and dangers to individuals.

In addition to the Final Rule, SAMHSA also issued a supplemental proposed rule seeking public input on the role of contractors, subcontractors and legal representatives in the health care system with respect to payment and health care operations. Comments on the proposed rule must be submitted by February 17, 2017.

SAMHSA will monitor implementation of the Final Rule and work to develop additional sub-regulatory guidance and materials on many of the finalized provisions. It is unclear how the incoming Trump administration will feel about these “midnight regulations”.