The U.S. Department of Health & Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) have issued a Proposed Rule to revise 42 C.F.R. Part 2 (Part 2 Regulations) – the federal regulations that strictly govern the confidentiality of certain alcohol and drug abuse patient records. The Part 2 Regulations were originally promulgated out of great concern for the potential misuse of alcohol and substance abuse information against individuals for law enforcement purposes which could result in these individuals not seeking needed treatment due to fear of prosecution or other adverse action.
The Part 2 Regulations were written 25 years ago when medical records were largely in paper format – long before the federal electronic health record (EHR) incentive programs were created and before the corresponding widespread use of EHR and health information exchanges (HIEs). SAMHSA recognized the need to modernize the Part 2 Regulations and made policy changes to facilitate the electronic exchange of information for treatment and other legitimate health care purposes while still ensuring appropriate confidentiality of records that might identify an individual directly or indirectly as having a substance abuse disorder.
Proposed Changes
SAMHSA proposes several changes to clean up the definitions currently used in the Part 2 Regulations, noting that defined terms in the current Part 2 Regulations are used inconsistently. For example, SAMHSA proposes to refer to alcohol abuse and drug abuse collectively as a "substance use disorder." Additionally, the term "program" and "federally assisted alcohol and drug abuse program" are currently used interchangeably in the Regulations, but now SAMHSA proposes to define these terms collectively as "Part 2 Program." SAMHSA also proposes to modernize the section on security of Part 2 medical records to address both paper and electronic records. Other changes include expanding the ability to use Part 2 data for scientific research purposes. The Proposed Rule allows patient identifying information to be disclosed for scientific research but only in certain enumerated circumstances.
The biggest change is the Part 2 Proposed Rule attempts to loosen the stringent patient consent requirements to facilitate patient participation in HIEs, Accountable Care Organizations (ACOs), coordinated care organizations (CCOs) and similar organizations. Currently, with certain narrow exceptions, patients must expressly consent to each entity that might receive Part 2 data – which is impossible in an HIE situation. As a result, Part 2 Programs out of fear of criminal sanctions often deter or carve out Part 2 patients from participating in HIEs, ACOs, CCOs or any functions where sharing of data is essential.
To address this problem, SAMHSA proposes to permit in certain circumstances, general consent by the patient, such that the patient could designate an HIE and treating providers as the entities authorized to receive Part 2 information.
However, to balance this concession, SAMHSA proposes a "new" requirement of the Part 2 Program – a patient right to a List of Disclosures, which would allow Part 2 patients who have included a general designation in their consent forms to request and be provided a list of entities to which their information has been disclosed pursuant to the general designation. The Part 2 Proposed Regulations also revise the "amount and kind" provision to require the consent form to explicitly describe the substance use disorder related information being disclosed. There is also a requirement to include a statement on the consent form that patients understand the terms of their consents and their rights to request and be provided a list of entities to whom their information has been disclosed when patients include a general designation in a consent form. In short, the relaxing of the single consent requirement in the Proposed Rule is two steps forward and one huge step backwards – adding additional burdens for Part 2 Programs.
The full text of the Part 2 Proposed Rule can be found here.
Further Change or Clarification is Needed to the Proposed Part 2 Regulations
While the Part 2 Proposed Rule creates more consistency in terminology and provides much needed and long overdue updates, the Proposed Rule does not address some of the other issues with Part 2 Regulations. As such, Part 2 Programs should take note and submit public comments to HHS regarding the need to address the remaining gaps in the current and Proposed Regulations such as the following:
- Scope of List of Disclosures: The Proposed Part 2 Regulations do not indicate the scope of the List of Disclosures. For example, the Part 2 Proposed Rule does not state whether the Part 2 Program must request a List of Disclosures from outside parties. If Part 2 Programs are required to provide that level of detail on its List of Disclosures, it will be administratively burdensome, if not impossible, for the Part 2 Program and its subcontractors.
- Payment: Unlike HIPAA Privacy Rules, Part 2 Regulations do not include an exception for payment purposes. Part 2 Programs cannot submit information to insurance payors without the patient's consent and the consent must be specific to all disclosures related to the claim. Consent could technically be unreasonably withheld by the patient and could prevent the Part 2 Program from getting paid for services rendered.
- Embedded Records: Part 2 Regulations should be revised to clarify whether embedded information within an acute care record is or is not covered by Part 2 Regulations.
- Due Diligence: Unlike the HIPAA Privacy Rules, the Part 2 Regulations do not appear to have a due diligence exception to allow a Part 2 Program's records to be reviewed in the event of proposed sale of the Part 2 facility.
- Grants: Part 2 Regulations do not have an exception to allow disclosure of Part 2 records in connection with the seeking of a grant or much needed funding for substance abuse patients.
- Qualified Service Organizations (QSO): QSOs are still fairly esoteric and undefined. Many of the comments in the SAMSHA guidance should be incorporated into the Proposed Part 2 Regulations in order to clarify such things as whether QSOs may or may not re-disclose Part 2 data to other QSOs (such as the QSO's subcontractors).
The above are just a few of the clarifications that need to be made in the Part 2 Regulations. SAMHSA has noted that the Proposed Rule is an effort to make the Part 2 Regulations more understandable and less burdensome. Interested parties may wish to point out to SAMHSA during the public comment phase that further revisions are necessary to address some of the many impracticalities of the Part 2 Regulations. Comments to the Proposed Part 2 Regulations must be submitted by April 11, 2016.
Baker Donelson is available to assist clients in drafting and submitting comments related to these and other gaps in the Part 2 Regulations. We also assist clients with privacy, security, breach notification, Part 2 policies, procedures, forms and training.
For more information on how these issues may affect your business, or for more information on other privacy and cybersecurity topics, contact the authors of this article (listed below) or any member of the Firm's Privacy and Information Security Team.