Electronic Healthcare Records , Governance & Risk Management , HIPAA/HITECH
HHS Modifies Some Substance Use Disorder Privacy Provisions
Are More Regulatory Changes on the Horizon?
The Department of Health and Human Services has finalized changes to certain privacy provisions related to the sharing of patient records associated with federally assisted substance use disorder treatment programs. The changes aim to improve treatment of some patients addicted to opioids and similar drugs.
See Also: OnDemand | Driving Security, Privacy, & Compliance Goals by Accelerating HITRUST Certification
The regulation that has been modified - Confidentiality of Substance Use Disorder Patient Records, more commonly known as 42 CFR Part 2 – had mostly prohibited the sharing of patient records with other healthcare providers by certain federally funded substance disorder and treatment programs.
In a statement Monday, HHS’ Substance Abuse and Mental Health Services Administration said the regulatory changes “advance the integration of healthcare for individuals with substance use disorders while maintaining critical privacy and confidentiality protections.”
Under the Part 2 regulation, a federally assisted substance use disorder program usually can disclose patient identifying information only if it obtains the individual’s written consent or gets permission via a court order, HHS notes. As a result of the changes, healthcare providers - with patients’ consent - will be able to more easily conduct activities such as quality improvement, claims management, patient safety, training and program integrity efforts, HHS notes.
With the changes to 42 CFR Part 2, HHS SAMHSA also crosses off a lingering to-do task from its 2020 regulatory agenda (see: HHS Hopes to Tackle Long-Stalled Regulatory Tasks).
Last August, HHS SAMHSA issued a proposed rule modifying provisions of 42 CFR Part 2 to improve care coordination of patients participating in federally assisted Part 2 programs (see: HHS Proposes Changes to Substance Abuse Data Disclosures).
“This reform will help make it easier for Americans to discuss substance use disorders with their doctors, seek treatment and find the road to recovery,” said Alex Azar, HHS secretary in the statement Monday.
Same “Framework’
HHS SAMHSA stresses that certain key aspects of Part 2 regulations have not been changed. “The revised rule does not alter the basic framework for confidentiality protection of substance use disorder – SUD - patient records created by federally assisted SUD treatment programs,” HHS says.
”Part 2 continues to prohibit law enforcement’s use of SUD patient records in criminal prosecutions against patients, absent a court order,” HHS says. “Part 2 also continues to restrict the disclosure of SUD treatment records without patient consent, other than as statutorily authorized in the context of a bona fide medical emergency; or for the purpose of scientific research, audit, or program evaluation; or based on an appropriate court order.”
What’s Changed
An HHS SAMHSA fact sheet issued Monday lists a variety of modifications to 42 CFR Part 2, and why the changes were made. Among the changes:
- Applicability and Re-Disclosure: Treatment records created by non-Part 2 providers based on their own patient encounters are explicitly not covered by Part 2, unless any substance use disorder records previously received from a Part 2 program are incorporated into those patient records. “Segmentation or holding a part of any Part 2 patient record previously received can be used to ensure that new records created by non-Part 2 providers will not become subject to Part 2,” HHS notes. HHS says this change was made to facilitate coordination of care activities by non-Part-2 providers.
- Consent Requirements: A substance use disorder patient now may consent to disclosure of their Part 2 treatment records to an entity – such as the Social Security Administration - without naming a specific person at the entity as the recipient for the disclosure. HHS says this change was made to allow patients to apply for benefits and resources more easily, for example, when using online applications that do not identify a specific person as the recipient for disclosure of Part 2 records.
- Disclosures Permitted with Written Consent: Disclosures for the purpose of “payment and healthcare operations” are permitted with written patient consent, in connection with a list of 18 activities – such as care coordination and case management - that constitute payment and healthcare operations now specified under the regulatory provision. HHS notes this change was made to resolve “lingering confusion” under Part 2 about what activities count as “payment and healthcare operations.”
- Disposition of Records: When a substance use disorder patient sends an incidental message to the personal device of an employee of a Part 2 program, the employee will be able to fulfill the Part 2 requirement for “sanitizing” the device simply by deleting that message. This change was made to ensure that the personal devices of employees will not need to be confiscated or destroyed in order to sanitize in compliance with Part 2.
- Research: Disclosures for research under Part 2 are permitted by a HIPAA covered entity or business associate to individuals and organizations that are neither HIPAA covered entities nor subject to the Common Rule for research on human subjects. This change was made to facilitate appropriate disclosures for research by streamlining overlapping requirements under Part 2, the HIPAA Privacy Rule and the Common Rule.
More to Come?
While the modifications to Part 2 announced this week could help improve care coordination for substance use disorder patients who participate in Part 2 programs, other more significant changes are also still likely, some experts note.
”These changes are part of a continuing process to bring Part 2 closer to the HIPAA standard that governs all other medical information at the federal level,” notes privacy attorney Kirk Nahra of the law firm WilmerHale. ”This incremental step is useful, but a very partial additional step."
The big next step is to enact legislative changes brought on by the CARES Act, he explains. Those changes “will revise the statute - and not just the rule - so that this information can move all the way to the HIPAA standard, while still protecting patients from having this information used against them in law enforcement proceedings, which was one of the original drivers of the law back in the 1970s.”
The CARES Act contains provisions calling for close alignment of 42 CFR Part 2 with HIPAA.
