Healthcare Law Alert: Proposed Amendments to Regulations Concerning Confidentiality of Substance Use Disorder Treatment Records
The U.S. Department of Health & Human Services (HHS), Substance Abuse and Mental Health Services Administration (SAMHSA) has released a notice of proposed rulemaking (NPRM), published in the Federal Register on August 26, 2019. The proposed rules, if adopted, would amend the confidentiality regulations found at 42 C.F.R. Part 2 (Part 2 Rules).
The Part 2 Rules set forth numerous requirements concerning the confidentiality of patient information and records of individuals seeking or receiving substance use disorder (SUD) treatment at a program covered by the Part 2 Rules. In many instances, the Part 2 Rules are more stringent than HIPAA and in many instances inconsistent with HIPAA, making it difficult for SUD providers and non-SUD providers receiving such records to comply with both sets of regulations. According to SAMHSA, “[t]hese proposals were prompted by the need to continue aligning the regulations with advances in the U.S. health care delivery system, while retaining important privacy protections for individuals seeking treatment for substance use disorders (SUDs).” Comments to the NPRM are due no later than 5:00 p.m. on October 25, 2019.
What Is Not Changing
In a Proposed Rule Fact Sheet, (Fact Sheet) HHS notes that the basic framework of the confidentiality protections afforded under the regulations will not be changing. The Part 2 Rules “will continue to prohibit law enforcement use of SUD patient records in criminal prosecution against the patient. Part 2 will also continue to restrict the disclosure of SUD treatment records without patient consent, other than as statutorily authorized in the context of a bona fide medical emergency; or for the purpose of scientific research, audit, or program evaluation; or based on an appropriate court order for good cause.”
The protections of the Part 2 Rules, which predate HIPAA, historically have been in place to shield SUD patients from bias and discrimination faced by such patients in many areas of life, including in the workplace and with respect to certain types of health care, and to protect SUD patients from adverse consequences that may result from release of such information in criminal and domestic proceedings.
Key Proposed Changes
Applicability and Re-Disclosure
Treatment records created by non-Part 2 providers based on their own patient encounters will not be covered under the Part 2 Rules, unless any SUD records previously received from a Part 2 program are incorporated into those records. However, non-Part 2 providers may segment records received from a Part 2 program from the remainder of the patient’s record, in order to avoid subjecting the entire patient record to the Part 2 requirements. The stated purpose of this amendment is to facilitate care coordination by non-Part 2 providers.
Disposition of Records
Employees of a Part 2 program will be able to “sanitize” a personal device on which the employee received an incidental patient message by simply deleting the message rather than having the device confiscated or destroyed.
Previously amended consent requirements will be further amended to permit a SUD patient to consent to disclosure of his or her patient records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure. The stated purpose of this amendment is to enhance the ability of individuals to apply for and obtain benefits and resources, e.g., when an online application does not permit identity of a specific person as the recipient of the patient information.
Disclosures Permitted with Written Consent
In order to resolve confusion about what activities constitute “payment” and “health care operations,” which are permitted with written consent, a list of 17 “illustrative examples” will be included in the body of the regulations.
Disclosures to Central Registries and PDMPs
Non-opioid treatment program (OTP) providers will become eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program.
OTPs will be permitted to enroll in a state prescription drug monitoring program (PDMP), and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.
The definition of “medical emergencies” for which disclosure of patient identifying information may be made without obtaining patient consent, will be expanded to include emergencies resulting from natural disasters, such as hurricanes, that disrupt treatment facilities and services.
Changes will be made to the research provisions of the regulations, in order to facilitate appropriate research disclosures and streamline overlapping requirements under HIPAA, the Part 2 Rules and the Federal Policy for the Protection of Human Subjects, also known as the Common Rule.
Audit and Evaluation
The “audit and evaluation” provisions of the Part 2 Rules, for which disclosures may be made without obtaining patient consent, will be revised to clarify ambiguity regarding the scope of permitted disclosures for such purposes.
Undercover Agents and Informants
Changes will be made to provisions permitting the court-ordered placement of undercover agents or informants within the premises of a Part 2 Program.
On the same date as the NPRM, SAMHSA issued a second notice of proposed rulemaking (Second NPRM), proposing to amend the Part 2 Rules to clarify one of the conditions under which a court may authorize disclosure of confidential communications made by a patient to a Part 2 program. In particular, the change will make clear that a court may authorize disclosure of confidential communications when the disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, even if the extremely serious crime was not allegedly committed by the patient.
The amendment is intended to correct an erroneous addition to the Part 2 Rules made when the regulations were previously amended in 2017. Comments to the Second NPRM are due no later than 5:00 p.m. on September 25, 2019.