The final rule on 42 CFR Part 2, issued by the Substance Abuse and Mental Health Services Administration (SAMHSA) in January, essentially keeps the confidential protections that were in the proposed rule.
We talked with Karla Lopez, senior staff attorney at the Legal Action Center, about how the final rule affects opioid treatment programs (OTPs). She explained that the new rule maintains not only the core protections, but also the basic requirement that patients consent to having their information disclosed.
In addition, the new rule maintains the prohibitions on re-disclosure—meaning that when the patient consents to having information released to a particular individual, the individual receiving the information may not re-disclose it to a third party.
The rule requires that consent be given to a “specific name,” but the patient can agree to a “general designation” instead. “This allows for flexibility, which was the purpose of revising the regulation,” said Ms. Lopez. “But it still gives the patient the choice of whether they want the OTP to have that flexibility.”
Background
OTPs and patient advocates were among the strongest supporters of retaining the privacy protections of 42 CFR Part 2. The challenge to these protections started with the electronic health record proponents who couldn’t understand the CFR rule.
Effectively, the rule kept OTP patient records out of a patient’s general electronic health record, and required the OTP to get the patient’s consent, in writing, to each person who would receive the EHR. SAMHSA, which promulgates the CFR rule, began making proposed changes in response to the electronic health issues. These issues, in turn, were in part coming from the federal government itself, which was backing universal electronic health records.
In the end, after many hearings and controversies, SAMHSA upheld the key protections of 42 CFR Part 2, which some critics had recommended scrapping completely. These critics claimed that stigma against patients in treatment for substance use disorders (SUDs) no longer existed. Among those who wanted to get rid of the privacy protections was The American Society of Addiction Medicine (ASAM). Standing firm in favor of keeping 42 CFR Part 2: The American Association for the Treatment of Opioid Dependence (AATOD).
Consent Form
The preamble as well as the text of the final rule make it clear that it is the responsibility of the treatment program—the OTP in this case—to explain the patient’s rights, said Ms. Lopez. She added that the final rule says the consent form “should be written in plain language.”
The final rule, like the proposed rule, makes it easier to add a generalized “to whom” section of the consent form, in terms of who gets to access patient information. But Ms. Lopez said protections are still there. “The new consent requirements are specific and stringent,” she said. For example, the consent form must indicate the “amount and kind of information that will be disclosed,” so patients know exactly what they are signing.
The patient does not have an option to allow disclosure of all personal health information, which is good, said Ms. Lopez. The generalized consent form still has an option limiting the consent to recipients who are treating the patient,” she pointed out. There can’t be that kind of disclosure to a health insurance company, for example.
Uncertain Future of ACA
The uncertainty about the future of the Affordable Care Act (ACA) under President Trump and the Republican Congress doesn’t affect the importance of 42 CFR Part 2, said Ms. Lopez; “42 CFR Part 2 long predated the ACA.” The incentives for electronic health records, which have become part and parcel of the ACA-driven health care system, were in fact from the HITECH (Health Information Technology for Economic and Clinical Health Act, signed into law in 2009), not from the ACA. The Act amended HIPAA (Health Insurance Portability and Accountability Act of 1996). The key reason for 42 CFR Part 2—patient confidentiality—is preserved, so that people are not afraid to seek treatment for SUDs.
In addition, patients are doubly covered in many states because of state laws that protect the confidentiality of personal health information regarding issues such as SUDs, sexually transmitted diseases, and HIV. The main reason for these protections is to encourage patients to seek treatment, with the goal of protecting public health.
Karla LopezEven if 42 CFR Part 2 did go away—and there is no indication that it will—health information exchanges (HIEs) would still have to protect sensitive health information, said Ms. Lopez. Finally, under the HITECH act, someone self-paying for treatment—as is the case in many self-pay OTPs—has the option to request that their information not be disclosed.
“SAMHSA worked really hard to get a lot of input over a number of years,” said Ms. Lopez. “It’s not an easy balance to strike. SAMHSA maintained core protections and made some significant changes that made things easier for researchers and for health information exchanges.”
(Researchers were pleased with the changes allowing them to use data sets without the impositions of 42 CFR Part 2, so they could better study the relationship between SUDs and other health issues.)
On the same day SAMHSA released the final rule, it released a supplemental notice of proposed rulemaking regarding how to share with contractors information that is protected under 42 CFR Part 2.
Final Rule Provisions
Provisions in the final rule, according to SAMHSA:
- SAMHSA will allow any lawful holder of patient identifying information to disclose Part 2 patient identifying information to qualified personnel for purposes of conducting scientific research if the researcher meets certain regulatory requirements. SAMHSA also permits data linkages to enable researchers to link to data sets from data repositories holding Part 2 data if certain regulatory requirements are met. These will enable more needed research on substance use disorders.
- SAMHSA will continue to apply Part 2 rules when a program is federally assisted and holds itself out as providing substance use disorder diagnosis, treatment, or referral for treatment.
- SAMHSA will allow a patient to consent to disclosing their information using a general designation to individual(s) and/or entity(-ies)(e.g., “my treating providers”) in certain circumstances. This change is intended to allow patients to benefit from integrated health care systems. This provision also ensures patient choice, confidentiality, and privacy as patients do not have to agree to such disclosures.
- SAMHSA has added a requirement allowing patients who have agreed to the general disclosure designation, the option to receive a list of entities to whom their information has been disclosed to, if requested.
- SAMHSA has made changes that outline the audit or evaluation procedures necessary to meet the requirements of a CMS-regulated accountable care organization or similar CMS-regulated organizations (including CMS-regulated Qualified Entities). This change will ensure CMS-regulated entities can perform necessary audit and evaluations activities, including financial and quality assurance functions critical to Accountable Care Organizations and other health care organizations.
- SAMHSA has updated and modernized the rule to address both paper and electronic documentation.
- SAMHSA will monitor implementation of the final rule and is working to develop additional sub-regulatory guidance and materials on many of the finalized provisions.
Supplemental proposal provisions:
- A new provision clarifying and limiting circumstances in which disclosures to contractors, subcontractors and legal representatives of lawful holders may receive and utilize Part 2 data for purposes of carrying out the lawful holder’s payment and health care operations activities.
- SAMHSA also seeks public comment on an abbreviated alternative statement for the notice to accompany disclosure.
- A new provision outlining CMS-regulated entities’ (e.g., ACO’s and QE’s) use of contractors, subcontractors and legal representatives to carry out audit and evaluation activities that are necessary to meet the requirements of a CMS-regulated program.
All Regulations on Hold
Both the final rule and the supplemental proposed rule were put on hold on January 20, when President Trump took office. The rule was supposed to take effect February 17, the effective date is now March 21.
It is not clear whether the final rule would then go forward as planned, or whether the administration would take additional actions, said Ms. Lopez. The impact on the supplemental notice of proposed rulemaking is unclear.
For the final rule, go to https://www.federalregister.gov/documents/2017/01/18/2017-00719/confidentiality-of-substance-use-disorder-patient-records
For the supplemental notice of proposed rulemaking regarding contractors and legal representatives, go to https://www.federalregister.gov/documents/2017/01/18/2017-00742/confidentiality-of-substance-use-disorder-patient-records.
Update on Final Rule
March 21, 2017 has been confirmed as the effective date the final rule as published in the Federal Register on February 16, 2017 and is available at: https://www.federalregister.gov/documents/2017/02/16/2017-03185/confidentiality-of-substance-use-disorder-patient-records-delay-of-effective-date
Update on Supplemental Notice
Comments must be received by 5 PM Eastern time on February 17, 2017