New Rule Makes it Easier to Share Substance Abuse Information While Protecting Privacy

The U.S. Department of Health and Human Services recently finalized changes to federal regulations relating to the confidentiality of substance-use disorder patient records.

Published in the Federal Register on January 18, the rule makes it easier to share the medical history of patients undergoing substance abuse treatment in federally funded drug and alcohol treatment programs, while at the same time continuing to protect their privacy and confidentiality.

While the old rule required patients to consent each time their data was shared or accessed, the new rule allows patients to sign one consent form allowing their information to be shared by designating the intended recipient.

The rules that govern the confidentiality of substance use disorder records, often referred to as “Part 2,†were developed in 1975 because of the concern that if the identities of those being treated for substance use were revealed they might become the target of criminal prosecution and other serious social consequences. As a result, they might not seek treatment.

In February 2016, HHS issued a notice of proposed rulemaking recommending changes to Part 2 that would better reflect the current healthcare delivery system, promote health integration and permit appropriate research and data exchange activities. HHS suggests the final rule “carefully balances the public health benefits of information exchange and continued protection of patient privacy.â€

The Substance Abuse and Mental Health Services Administration (SAMHSA) is the agency within the U.S. Department of Health and Human Services that leads public health efforts to advance the behavioral health of the nation. It notes that the major provisions of the new rule are as follows:

• Any lawful holder of patient identifying information will be permitted to disclose Part 2 patient identifying information to qualified personnel for purposes of conducting scientific research if the researcher meets certain regulatory requirements. SAMHSA also permits data linkages to enable researchers to link to data sets from data repositories holding Part 2 data if certain regulatory requirements are met. These will enable more needed research on substance use disorders.
• Part 2 rules will continue to apply when a program is federally assisted and holds itself out as providing substance use disorder diagnosis, treatment, or referral for treatment.
• A patient will be allowed to consent to disclosing their information using a general designation to individuals or entities (for example “my treating providersâ€) in certain circumstances. This change is intended to allow patients to benefit from integrated healthcare systems. This provision also ensures patient choice, confidentiality, and privacy as patients do not have to agree to such disclosures.
• An added requirement allows patients who have agreed to the general disclosure designation, the option to receive a list of entities to whom their information has been disclosed to, if requested.
• Changes have been made that outline the audit or evaluation procedures needed to meet the requirements of a CMS-regulated accountable care organization or similar CMS-regulated organizations (including CMS-regulated Qualified Entities). This change will ensure CMS-regulated entities can perform necessary audit and evaluations activities, including financial and quality assurance functions critical to Accountable Care Organizations and other healthcare organizations.
• The rule has been updated and modernized to address both paper and electronic documentation.
• The final rule’s implementation will be monitored by SAMHSA, which is working to develop additional sub-regulatory guidance and materials on many of the finalized provisions.

The rule was to take effect Feb. 17. However, a presidential memorandum issued on Jan. 20 directs that all regulations that have not yet taken effect, if permitted by applicable law and not subject to an exception, be temporarily postponed for 60 days from January 20 “for the purpose of reviewing questions of fact, law, and policy they raise.â€

This means that the effective date for the final rule is delayed until at least March 21. If SAMHSA determines that the final rule raises “substantial questions of law or policy,†further action could be taken, including a possible delay or withdrawal of the rule or request for additional comment.

While we see no reason for this rule not to take effect, nothing is certain in this changing political landscape. We will keep on top of the matter and let you know as developments occur. In the meantime, however, it is important to ensure that your practice is HIPAA compliant.

The Health Law Offices of Anthony C. Vitale can assist clients in healthcare privacy-related matters. Feel free to contact us for additional information at 305-358-4500 or send us an email to info@vitalehealthlaw.com and let’s discuss how we might be able to assist you.